Path Traversal in Aiohttp
CVE-2025-69226
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.003 (23.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Aiohttp
- Aio-libs Aiohttp — versions < 3.13.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-69226?
- CVE-2025-69226 is a medium-severity vulnerability in Aiohttp, classified under Path Traversal. CVSS score: 5.3/10. Published 2026-01-05.
- How severe is CVE-2025-69226?
- Medium severity. CVSS v3 base score is 5.3 out of 10.