CVE-2025-69226

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.

CVSS 4.0

6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-25)

CWEs

CWE-22, CWE-200

Published

2026-01-05

Modified

2026-10-11

Record from

the NVD, synced 2026-10-19

Affected

• aiohttp:aiohttp

Packages (OSV)

References

• https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76

Check your stackJSON