GitHub Advisoryadvisory · PyPI

GHSA-54jq-c3m8-4m76 AIOHTTP vulnerable to brute-force leak of internal static file path components

LOW Published 2026-01-05 Modified 2026-01-06 Official page ↗
Aliases
CVE-2025-69226
Ecosystem
PyPI
Packages
aiohttp
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-202, CWE-22
Reviewed
2026-01-05

Affected packages

• PyPI aiohttp: < 3.13.3 → fixed in 3.13.3

Description

Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components. Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. ------ Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e

Related

Alias · CVE (1)

  • CVE-2025-69226 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (2)

  • CWE-202 Exposure of Sensitive Information Through Data Queries weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References