What is CVE-2025-66221?

CVE-2025-66221 is a medium-severity vulnerability in Microsoft Windows, classified under CWE-67. CVSS score: 5.3/10. Published 2025-11-29.

How severe is CVE-2025-66221?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Microsoft Windows

CVE-2025-66221

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.

Published 2025-11-29 · last modified 2026-10-07.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.005 (42.3th percentile), scored 2026-10-20.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 42.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-67

References

github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2 (Vendor Advisory)
github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13 (Patch)
github.com/pallets/werkzeug/releases/tag/3.1.4 (Release Notes)

Frequently asked questions

What is CVE-2025-66221?: CVE-2025-66221 is a medium-severity vulnerability in Microsoft Windows, classified under CWE-67. CVSS score: 5.3/10. Published 2025-11-29.
How severe is CVE-2025-66221?: Medium severity. CVSS v3 base score is 5.3 out of 10.