AIOHTTP vulnerable to brute-force leak of internal static file path components

The primary impact of CVE-2025-69226 stems from the ability for an attacker to enumerate file paths within the application's static file directory. This information, while not granting direct access to files, can be valuable for reconnaissance. An attacker could use this knowledge to identify sensitive files, understand the application's directory structure, and potentially plan further attacks. The vulnerability is specifically tied to the use of web.static(), which is discouraged for production deployments due to inherent security risks. The disclosure of path components could lead to information leakage and facilitate more targeted attacks.

Applications utilizing aiohttp version 3.9.5 or earlier, particularly those employing the web.static() function for serving static files, are at risk. Python developers building web applications and relying on aiohttp for HTTP handling should prioritize upgrading their dependencies.

• python / server:

import aiohttp
print(aiohttp.__version__)

• python / supply-chain: Check project dependencies for aiohttp versions <= 3.9.5 using pip freeze | grep aiohttp. • generic web: Inspect application logs for requests targeting static files with unusual path parameters.

1. 2026-01-05Disclosure

   disclosure

2. 2026-01-05Patch

   patch

1. Reservado2025-12-29
2. Publicada2026-01-05
3. Modificada2026-02-04
4. EPSS atualizado2026-03-23

The recommended mitigation for CVE-2025-69226 is to upgrade to aiohttp version 3.13.3 or later. If upgrading is not immediately feasible, avoid using web.static() in production environments. Consider implementing a Web Application Firewall (WAF) with rules to prevent path manipulation attempts. While a direct detection signature is not readily available, monitor application logs for unusual path requests or attempts to access static files outside of expected patterns. The fix involves improved path normalization to prevent the disclosure of absolute path components.