CWE-67 · File and Path Handling
Improper Handling of Windows Device Names
7CVEs
SortMost likely exploited
7 CVEs with CWE-67 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-51745Wasmtime doesn't fully sandbox all the Windows device filenamesbytecodealliance · wasmtime · CVSS 2.3 · 2024-11-05 | 2.3 | 0.8% | 2024-11-05 |
| CVE-2026-27199Werkzeug safe_join() allows Windows special device namespallets · werkzeug · CVSS 6.3 · 2026-02-21 | 6.3 | 0.6% | 2026-02-21 |
| CVE-2025-66221Werkzeug safe_join() allows Windows special device namespallets · werkzeug · CVSS 6.3 · 2025-11-29 | 6.3 | 0.5% | 2025-11-29 |
| CVE-2026-21860Werkzeug safe_join() allows Windows special device names with compound extensionspallets · werkzeug · CVSS 6.3 · 2026-01-08 | 6.3 | 0.5% | 2026-01-08 |
| CVE-2024-35197gix refs and paths with reserved Windows device names access the devicesByron · gitoxide · CVSS 5.4 · 2024-05-23 | 5.4 | 0.4% | 2024-05-23 |
| CVE-2026-102598Werkzeug safe_join() allows Windows special device namespallets · werkzeug · CVSS 6.3 · 2026-09-29 | 6.3 | 0.4% | 2026-09-29 |
| CVE-2026-17545PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoSPHP Group · PHP · CVSS 6.9 · 2026-09-25 | 6.9 | 0.4% | 2026-09-25 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.