Vulnerability · Published Jan 5, 2026 · Assigned by GitHub_M
CVE-2025-69226AIOHTTP allows for a brute-force leak of internal static filepath components
Medium 6.3
In plain English
A medium-severity path traversal in aiohttp from aio-libs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | py3-aiohttp | 3.13.3-r0 | ALPINE-CVE-2025-69226 |
| Alpine:v3.24 | py3-aiohttp | 3.13.3-r0 | ALPINE-CVE-2025-69226 |
| Debian:12 | python-aiohttp | 3.8.4-1+deb12u2 | DEBIAN-CVE-2025-69226 |
| Debian:13 | python-aiohttp | 3.11.16-1+deb13u1 | DEBIAN-CVE-2025-69226 |
| Debian:14 | python-aiohttp | 3.13.3-1 | DEBIAN-CVE-2025-69226 |
| PyPI | aiohttp | 3.13.3 | PYSEC-2026-1097 |
| PyPI | aiohttp | 3.13.3 | GHSA-54jq-c3m8-4m76 |
| Ubuntu:25.10 | python-aiohttp | 3.11.16-1ubuntu0.1 | UBUNTU-CVE-2025-69226 |
Affected products (as reported)
Weakness: CWE-22, CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N