Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
python-aiohttp may reveal file locations
published 10 months ago
Summary
The python-aiohttp library used for web services can unintentionally show whether certain files exist on the server when static files are served. This could let an attacker learn about the server’s file structure. Upgrade to version 3.13.3 or later to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | python-aiohttp | <= 3.6.2-3 |
Original advisory text
CVE-2025-69226 affecting package python-aiohttp 3.6.2-3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
References
Timeline
Published5 Jan 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-73526 · OSV
Track software like this
Free during beta