cve.bz

CWE-67: Improper Handling of Windows Device Names

Filter

The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

What the weakness is: CWE-67 at MITRE. All weaknesses

Ask an AI about CWE-67

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-67: Improper Handling of Windows Device Names and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/67.html and https://cve.bz/cve/cwe/67?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.3CVE-2026-102598EPSS 0.4%

    Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an em…

  2. 6.9CVE-2026-17545EPSS 0.4%

    On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefor…

  3. 6.3CVE-2026-27199EPSS 0.6%

    Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, bu…

  4. 6.3CVE-2026-21860EPSS 0.5%

    Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special devi…

  5. 6.3CVE-2025-66221EPSS 0.5%

    Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are impli…

  6. 2.3CVE-2024-51745EPSS 0.8%

    Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to …

  7. 5.4CVE-2024-35197EPSS 0.4%

    gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repo…