CVE-2025-69226
6.3
AIOHTTP Side-Channel: When 403 Means 'I See You'
Amit Schendel
Senior Security ResearcherJan 6, 2026·6 min read·14 visits
PoC Available
Executive Summary (TL;DR)
AIOHTTP versions prior to 3.13.3 contain a side-channel vulnerability in `web.static()`. The framework checked path prefixes before normalizing them, creating an oracle where attackers can distinguish between existing and non-existing files on the host system. If you get a 403, the file exists; if you get a 404, it doesn't. Upgrade to 3.13.3 immediately.
A logic flaw in AIOHTTP's static file serving mechanism allows attackers to map the server's internal filesystem. By exploiting differences in error codes (403 vs 404) during path normalization, adversaries can enumerate sensitive files outside the web root.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS Score
6.3/ 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NAffected Systems
Python applications using aiohttp <= 3.13.2Systems exposing `web.static()` routes to the public internet
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
aiohttp aio-libs | <= 3.13.2 | 3.13.3 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-22 (Path Traversal) |
| CWE ID | CWE-200 (Information Exposure) |
| Attack Vector | Network (CVSS: AV:N) |
| CVSS v4.0 | 6.3 (Medium) |
| Impact | Information Disclosure (Filesystem Enumeration) |
| Exploit Status | PoC Available / Functional Exploit |
| Patch Status | Fixed in 3.13.3 |
MITRE ATT&CK Mapping
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as '..' that can resolve to a location that is outside of that directory.
Known Exploits & Detection
Vulnerability Timeline
Vulnerability Disclosed
2026-01-05
Patch Released (v3.13.3)
2026-01-05