{"cve":"CVE-2025-69226","nvd":{"published":"2026-01-05T23:15:40.913","modified":"2026-10-11T20:10:00.200","status":"Analyzed","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-22","CWE-200"],"references":["https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76"],"products":["aiohttp:aiohttp"],"source":"nvd","synced_at":"2026-10-19T22:19:41.481987139+00:00"},"epss":{"cve":"CVE-2025-69226","score":0.00368,"percentile":0.30364,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-54jq-c3m8-4m76","url":"https://osv.dev/vulnerability/GHSA-54jq-c3m8-4m76","summary":"AIOHTTP vulnerable to brute-force leak of internal static file path components","modified":"2026-09-10T03:50:32.751498447Z","packages":[{"ecosystem":"PyPI","name":"aiohttp","purl":"pkg:pypi/aiohttp","ranges":["<3.13.3"],"fixed":["3.13.3"]}]},{"id":"PYSEC-2026-1097","url":"https://osv.dev/vulnerability/PYSEC-2026-1097","summary":"AIOHTTP vulnerable to brute-force leak of internal static file path components","modified":"2026-07-07T17:46:18.706941624Z","packages":[{"ecosystem":"PyPI","name":"aiohttp","purl":"pkg:pypi/aiohttp","ranges":["<3.13.3"],"fixed":["3.13.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}