Risk Letters

Exploited vulnerability

CVE-2024-49766

TLP:CLEAR

palletsprojects werkzeug Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

Facts

  • Vendor: palletsprojects
  • Product: werkzeug
  • EPSS (probability of exploitation within 30 days): 0.8 %
  • First known exploitation: 30 September 2026
  • Used in ransomware campaigns (per CISA): Yes
  • First seen by Risk Letters: 30 September 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD