@@ -5,6 +5,8 @@ Version 3.1.9
 
 Unreleased
 
+-   ``safe_join`` on Windows does not allow special devices names with empty ADS
+    markers on NTFS. :ghsa:`g6x2-hccm-hh4m`
 -   ``ProfilerMiddleware`` uses ``profiling.tracing`` on Python 3.15.
     :issue:`3207`
 -   ``uri_to_iri`` and ``iri_to_uri`` preserve empty username, password, and
 
@@ -173,6 +173,10 @@ def safe_join(directory: str, *untrusted: str) -> str | None:
         base directory.
     :return: A safe path, otherwise ``None``.
 
+    .. versionchanged:: 3.1.9
+        Special device names with empty ADS stream markers are not allowed on
+        Windows.
+
     .. versionchanged:: 3.1.6
         Special device names in multi-segment paths are not allowed on Windows.
 
@@ -206,7 +210,8 @@ def safe_join(directory: str, *untrusted: str) -> str | None:
             or (
                 os.name == "nt"
                 and any(
-                    p.partition(".")[0].strip().upper() in _windows_device_files
+                    p.partition(":")[0].partition(".")[0].strip().upper()
+                    in _windows_device_files
                     for p in part.split("/")
                 )
             )