Path Traversal Vulnerability in AIOHTTP Framework by Aio-libs
CVE-2025-69226

6.3MEDIUM

Key Information:

Vendor

Aio-libs

Status
Aiohttp
Vendor
CVE Published:
5 January 2026

What is CVE-2025-69226?

AIOHTTP, the asynchronous HTTP client/server framework, is susceptible to a path traversal vulnerability in versions 3.13.2 and earlier. This flaw allows attackers to exploit the path normalization logic, revealing the existence of absolute path components intended to be protected. If web applications utilize the web.static() method, which is not recommended for production, this vulnerability can be leveraged to identify sensitive path components. The issue has been remediated in version 3.13.3, and users are strongly advised to update to this version to safeguard their applications from potential exploitation.

Affected Version(s)

aiohttp < 3.13.3

References

https://github.com/aio-libs/aiohttp/security/advisories/G...
x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.