CVE-2024-42367Medium· 4.8▾ SunlitIn aiohttp, compressed files as symlinks are not protected from path traversal
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.6%
0.6% → 0.7%
Last analysed / modified upstream
Static routes which contain files with compressed variants (.gz or .br extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.
The server protects static routes from path traversal outside the root directory when follow_symlinks=False (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the FileResponse class, and symbolic links are then automatically followed when performing Path.stat() and Path.open() to send the file.
Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.
Patch: https://github.com/aio-libs/aiohttp/pull/8653/files
aiohttp >= 3.10.0b1, < 3.10.2Upgrade to a patched release:
aiohttp 3.10.2Connected by shared product, vendor, weakness, or advisory.
GHSA-pjjw-qhg8-p2p9Mediumaiohttp has vulnerable dependency that is vulnerable to request smuggling
CVE-2023-47627Medium· 5.3AIOHTTP has problems in HTTP parser (the python one, not llhttp)
CVE-2024-23334Medium· 5.9aiohttp is vulnerable to directory traversal
CVE-2026-59881MediumAIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-22815Mediumaiohttp allows unlimited trailer headers, leading to possible uncapped memory usage
CVE-2026-34515MediumAIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows