5.9
Medium
CVE-2024-23334 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| aiohttp 3.9 | earliest → < 3.9.2 | 3.9.2 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
Timeline
- Published
- Last modified
Other CVEs of aiohttp
The 53 CVEs of aiohttp →
CVE-2026-111750
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
6.3
Medium
CVE-2026-111749
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
2.3
Low
CVE-2026-111748
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
6.3
Medium
CVE-2026-111066
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
8.2
High