PT-2026-1351 · Aiohttp+4 · Aiohttp+4

Published 2026-01-05 · Updated 2026-04-20 · CVE-2025-69226

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below

Description AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, has an issue where versions 3.13.2 and below allow an attacker to determine the existence of absolute path components through the path normalization logic for static files. This is related to the use of the web.static() function, which is not recommended for production deployments. An attacker may be able to determine the existence of path components within the system.

Recommendations Update to version 3.13.3 or later.

Exploit

Fix

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

CWE-202

Related Identifiers

AZL-73503

AZL-73526

BDU:2026-07193

CVE-2025-69226

ECHO-7081-D4CF-1BF4

GHSA-54JQ-C3M8-4M76

OPENSUSE-SU-2026:10025-1

OPENSUSE-SU-2026:20204-1

SUSE-SU-2026:0858-1

SUSE-SU-2026:0859-1

SUSE-SU-2026:20425-1

USN-8032-1

Affected Products

Aiohttp

Debian

Linuxmint

Red Os

Ubuntu

References · 57

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69226.json · Exploit
• https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e · Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:0858-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10025-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69227 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69226 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69228 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8032-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20204-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8032-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-54jq-c3m8-4m76 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07193 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69226 · Security Note
• https://ubuntu.com/security/CVE-2025-69224 · Vendor Advisory