Path Traversal Vulnerability in aiohttp
Summary
CVE-2024-42367: In aiohttp, compressed files as symlinks are not protected from path traversal. Affects aiohttp versions >= 3.10.0b1, < 3.10.2. Fixed in 3.10.2. How to fix ↓
Also tracked for
- python-aiohttp · Debian:12
The same CVE-2024-42367 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is an asynchronous HTTP client/server framework for Python. It provides a powerful set of tools and features for building web applications. However, aiohttp versions up to 3.8.5 are vulnerable to a path traversal issue.
Vulnerability Detail
The vulnerability in aiohttp allows for path traversal outside the root directory when compressed files with symbolic links are used. This means that if a server has static routes containing compressed variants (.gz or .br extensions) as symbolic links, pointing outside the root directory, or if users are allowed to upload or create such links, they are impacted. The issue arises due to a lack of proper checks when looking for compressed variants in the FileResponse class, leading to automatic following of symbolic links and potential path traversal.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.10.2
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.10.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to ensure that compressed variants used in static routes are not symbolic links pointing outside the root directory. This can be achieved by verifying the file paths and avoiding the use of symbolic links for compressed files.
Conclusion
The path traversal vulnerability in aiohttp versions up to 3.8.5 can lead to unauthorized access to files outside the root directory. It is crucial to upgrade to version 3.10.2 or later to mitigate this issue. Alternatively, ensure that compressed variants used in static routes are not symbolic links pointing outside the root directory. Regularly monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for aiohttp →
FAQ
aiohttp is an asynchronous HTTP client/server framework for Python, widely used for building web applications.
Path traversal is a security vulnerability that allows an attacker to access files or directories outside the intended scope of an application.
Servers with static routes containing compressed variants as symbolic links, pointing outside the root directory, or allowing users to upload or create such links, are impacted. This can potentially lead to unauthorized access to sensitive files.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
