CVE-2025-69226 AIOHTTP allows for a brute-force leak of internal static filepath components

What is CVE-2025-69226?

CVE-2025-69226 is a medium-severity vulnerability in aio-libs aiohttp, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.

Weakness: CWE-22, CWE-200

Which versions are affected by CVE-2025-69226?

3 open source packages ship an affected version, including aiohttp. It affects 1 product.

Products include Aiohttp Aiohttp.

How do I fix CVE-2025-69226?

Upgrade aiohttp to 3.13.3 or later.

Is CVE-2025-69226 being exploited?

There is no known exploitation of CVE-2025-69226 in the wild and no public exploit code.

Other vulnerabilities in aio-libs aiohttp

• CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method High 8.7
• CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb High 7.5
• CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp High 7.5
• CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version High 7.2
• CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-73503, AZL-73526, CLEANSTART-2026-GO71625, CLEANSTART-2026-PD75328, CLSA-2026-1791456836, CLSA-2026-1791528872 and 8 more.