CVE-2019-14322

Pallets Werkzeug vulnerable to Path Traversal

7.5 HighPublic exploitFix available

CVE-2019-14322 is a high vulnerability (CVSS 7.5) in Palletsprojects Werkzeug, published July 28, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 55.8%, the 99th percentile. Fixed in werkzeug 0.15.5.

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

55.8%Up 51.2 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Record: CVE-2019-14322
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Record: CVE-2019-14322
Updated: 2026-11-02

EUVDEUVD-2022-4280 No score

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Record: EUVD-2022-4280
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j544-7q9p-6xp8 7.5

Pallets Werkzeug vulnerable to Path Traversal

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Record: GHSA-j544-7q9p-6xp8
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSV 7.5

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Record: CVE-2019-14322
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-j544-7q9p-6xp8 7.5

Pallets Werkzeug vulnerable to Path Traversal

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Record: GHSA-j544-7q9p-6xp8
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSVPYSEC-2026-1065 7.5

Pallets Werkzeug vulnerable to Path Traversal

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Record: PYSEC-2026-1065
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

palletsprojects werkzeug

Affected packages

Affected packages
Package	Affected	Fixed
`werkzeug` PyPI	before 0.15.5	0.15.5
`werkzeug` PyPI	before 0.15.5, plus listed versions 0.10.100.10.10.10.20.10.3 Show 45 moreShow less 0.10.40.110.11.10.11.100.11.110.11.120.11.130.11.140.11.150.11.20.11.30.11.40.11.50.11.60.11.70.11.80.11.90.120.12.10.12.20.130.140.14.10.15.00.15.10.15.20.15.30.15.40.20.30.3.10.40.4.10.50.5.10.60.6.10.6.20.70.7.10.7.20.80.8.10.8.20.8.3	0.15.5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Pallets Werkzeug 0.15.4 - Path Traversal	2021-07-06
Nuclei	Pallets Werkzeug <0.15.5 - Local File Inclusion
PoC in GitHub	faisalfs10x/CVE-2019-14322-scanner	2021-05-16
PoC in GitHub	faisalfs10x/http-vuln-cve2019-14322.nse	2021-05-17
PoC in GitHub	sergiovks/CVE-2019-14322	2024-09-19

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

References

This page doesn't list everything

Left out here: 7 versions. The JSON record has them.