-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2025-69226, is an information disclosure flaw in aiohttp's static file handling. When an application uses web.static(), an attacker can craft URLs with path traversal characters (e.g., ../) to probe for the existence of files and directories on the server's filesystem, outside of the intended static directory. The vulnerability is not a full path traversal that allows reading arbitrary files, but rather a brute-force technique where the server's response (or timing) reveals whether a given path component exists.
The root cause is the improper validation of the request path in the aiohttp.web_urldispatcher.StaticResource.resolve function. It checked if the path started with the expected prefix without first normalizing it. This allowed traversal sequences to be present in the URL.
The patch addresses this by introducing os.path.normpath() to canonicalize the path before performing the prefix check. This ensures that any traversal sequences are resolved, and the final path is correctly validated to be within the static root, thus preventing the information leak. The _handle method was also changed to remove a redundant and insufficient check for absolute paths, consolidating the security logic within the resolve method.
aiohttp.web_urldispatcher.StaticResource.resolveaiohttp/web_urldispatcher.py
aiohttp.web_urldispatcher.StaticResource._handleaiohttp/web_urldispatcher.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aiohttp | pip | <= 3.13.2 | 3.13.3 |