What is CVE-2025-66221?

CVE-2025-66221 is a medium-severity vulnerability in Microsoft Windows, classified under CWE-67. CVSS score: 5.3/10. Published 2025-11-29.

How severe is CVE-2025-66221?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Microsoft Windows

CVE-2025-66221

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.

EPSS: 0.005 (41.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Weakness classification (CWE)

CWE-67

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2025-66221?: CVE-2025-66221 is a medium-severity vulnerability in Microsoft Windows, classified under CWE-67. CVSS score: 5.3/10. Published 2025-11-29.
How severe is CVE-2025-66221?: Medium severity. CVSS v3 base score is 5.3 out of 10.