GitHub Advisoryadvisory · PyPI

GHSA-7gpw-8wmc-pm8g aiohttp Cross-site Scripting vulnerability on index pages for static file handling

MEDIUM Published 2024-04-18 Modified 2025-11-03 Official page ↗
Aliases
CVE-2024-27306
Ecosystem
PyPI
Packages
aiohttp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-18

Affected packages

• PyPI aiohttp: < 3.9.4 → fixed in 3.9.4

Description

Summary A XSS vulnerability exists on index pages for static file handling. Details When using `web.static(..., show_index=True)`, the resulting index pages do not escape file names. If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks. Workaround We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. ----- Patch: https://github.com/aio-libs/aiohttp/pull/8319/files

Related

Alias · CVE (1)

  • CVE-2024-27306 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References