CVE-2024-42367
mediumpriority · track · 19EPSS 0.006 · 51 %ileDEEURUUSEPSS · scored 2026-10-27
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (29)
Products and version ranges known to be affected.
- Oracle Siebel CRM Cloud Applications 17.0-24.12all versionscert_bundDEcpe:/a:oracle:siebel_crm:cloud_applications_17.0_-_24.12
- Oracle Siebel CRM Deployment 17.0-25.2all versionscert_bundDEcpe:/a:oracle:siebel_crm:deployment_17.0_-_25.2
- Oracle Siebel CRM End User 24.7-25.2all versionscert_bundDEcpe:/a:oracle:siebel_crm:end_user_24.7_-_25.2
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0809Oracle Siebel CRM: Mehrere SchwachstellenDeutsch2025-04-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-jwhx-xcg6-8xhjIn aiohttp, compressed files as symlinks are not protected from path traversal2024-08-09ghsa · osvUS
### Summary Static routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links. ### Details The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file. ### Impact Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted. ---- Patch: https://github.com/aio-libs/aiohttp/pull/8653/files
- PYSEC-2026-1108In aiohttp, compressed files as symlinks are not protected from path traversal2026-07-07vendor · osvUS
### Summary Static routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links. ### Details The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file. ### Impact Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted. ---- Patch: https://github.com/aio-libs/aiohttp/pull/8653/files
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-42367/cnnvd
- https://github.com/aio-libs/aiocnnvd
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhjPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-42367cnnvd
- https://vigilance.fr/vulnerability/aiocnnvd
- https://www.oracle.com/security-alerts/cpuapr2025.htmlcnnvd
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_fileresponse.py#L177enisa_euvd
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_urldispatcher.py#L674enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan