CVE-2025-69226: AIOHTTP Path Traversal Vulnerability Leading to Internal File Path Disclosure
Summary
CVE-2025-69226: AIOHTTP vulnerable to brute-force leak of internal static file path components. Affects aiohttp versions < 3.13.3. Fixed in 3.13.3. How to fix ↓
Also tracked for
The same CVE-2025-69226 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular asynchronous HTTP client/server framework for Python, designed to handle web requests and responses efficiently. It provides features like routing, middleware support, and static file serving. However, a vulnerability has been identified in its static file handling mechanism, which can lead to potential security risks if not addressed properly.
Vulnerability Detail
The vulnerability arises from improper path normalization for static files in AIOHTTP. While it prevents path traversal attacks, it inadvertently allows attackers to determine the existence of absolute path components on the server. This could lead to information disclosure, where an attacker gains insights into the server's directory structure, potentially aiding in further attacks. Applications using the 'web.static()' method are particularly at risk, especially if deployed in production environments.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.3
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.13.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'web.static()' method for serving static files in production environments. Instead, consider using a dedicated web server like Nginx or Apache to handle static file serving securely.
Conclusion
The CVE-2025-69226 vulnerability in AIOHTTP poses a risk of internal file path disclosure due to improper path normalization. It is crucial for developers using AIOHTTP to update to the patched version 3.13.3 or later and to consider alternative methods for serving static files in production environments.
See every vulnerability recorded for aiohttp →
FAQ
CVE-2025-69226 is a vulnerability in the AIOHTTP framework that allows attackers to ascertain the existence of internal file path components through improper path normalization.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to information disclosure, allowing attackers to gain insights into the server's directory structure, which may facilitate further attacks.
Yes, the vulnerability has been patched in version 3.13.3 of AIOHTTP. It is recommended to update to this version or later.
If immediate updates are not possible, avoid using the 'web.static()' method for serving static files and consider using a dedicated web server for better security.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
