What’s Vulnerable › Vulnerabilities

CVE-2025-69226: AIOHTTP allows for a brute-force leak of internal static filepath components

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-05 · updated 2026-10-11
• Weakness: CWE-22

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.

Affected products

• aio-libs aiohttp: before 3.13.3 — fixed in 3.13.3
• Pypi Aiohttp: before 3.13.3; 0.1, 0.10.0, 0.10.1, 0.10.2, 0.11.0, 0.12.0 (+297) — fixed in 3.13.3

How to fix

Upgrade to a fixed version: aio-libs aiohttp 3.13.3; Pypi Aiohttp 3.13.3. Check the vendor advisory for mitigations.

References

• https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76

Get alerted when CVE-2025-69226 or the next vulnerability affects your stack