In aiohttp, compressed files as symlinks are not protected from path traversal
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aio-libs | aiohttp | 3.10.0b1 to before 3.10.2 | 3.10.2 | Patch available | CNA |
| — | aiohttp (PyPI) | 3.10.0b1 to before 3.10.2 | 3.10.2 | Patch available | GHSA-jwhx-xcg6-8xhj |
- aiohttp Vendoraio-libs Affected 3.10.0b1 to before 3.10.2 Fixed in 3.10.2 Patch available CNA
- aiohttp (PyPI) Vendor— Affected 3.10.0b1 to before 3.10.2 Fixed in 3.10.2 Patch available GHSA-jwhx-xcg6-8xhj
Remediation
- Fix · CNA aiohttp (aio-libs) Fixed in 3.10.2
- Fix · GHSA-jwhx-xcg6-8xhj aiohttp (PyPI) Fixed in 3.10.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Lightspeed | Affected | — |
| Red Hat Ansible Automation Platform 1.2 | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | — |
| Red Hat Satellite 6 | Affected | — |
| Red Hat Update Infrastructure 4 for Cloud Providers | Affected | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-42367
- 2026-10-03 Alias added: GHSA-jwhx-xcg6-8xhj
- 2026-10-16 EPSS moved to the 50th–90th percentile
References
Advisory 2
Other 4
- https://github.com/aio-libs/aiohttp/pull/8653
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_fileresponse.py#L177
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_urldispatcher.py#L674
- https://github.com/aio-libs/aiohttp
More aio-libs vulnerabilities
- TI-2025-38826 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVSS 4.0HIGH 8.2
- TI-2024-15436 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVSS 3.1HIGH 7.5
- TI-2023-25769 Request smuggling in aiohttp CVSS 3.1HIGH 7.5
- TI-2023-18906 aiohttp vulnerable to HTTP request smuggling CVSS 3.1HIGH 7.5
- TI-2023-26746 aiohttp's ClientSession is vulnerable to CRLF injection via version CVSS 3.1HIGH 7.2
- TI-2026-66145 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-42367 · CVE Program
- CVE-2024-42367 · NVD
- FIRST EPSS
- GHSA-jwhx-xcg6-8xhj · GitHub Advisory Database · CC BY 4.0
- CVE-2024-42367 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences