https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:28:23 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-03462 bdu:2025-03462 https://cve.radiocsirt.org/vuln/bdu:2025-03462 https://cve.radiocsirt.org/vuln/brew-aider-cve-2024-42367 <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary Static routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.</p> <p>### Details The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file.</p> <p>### Impact Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.</p> <p>----</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/8653/files</p> <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary Static routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.</p> <p>### Details The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file.</p> <p>### Impact Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.</p> <p>----</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/8653/files</p> https://cve.radiocsirt.org/vuln/brew-aider-cve-2024-42367 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0873 certfr-2024-avi-0873 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0873 https://cve.radiocsirt.org/vuln/euvd-2026-243349 EUVD-2026-243349 https://cve.radiocsirt.org/vuln/euvd-2026-243349 https://cve.radiocsirt.org/vuln/fkie_cve-2024-42367 <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-42367 https://cve.radiocsirt.org/vuln/ghsa-jwhx-xcg6-8xhj <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Static routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.</p> <p>### Details The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file.</p> <p>### Impact Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.</p> <p>----</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/8653/files</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Static routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.</p> <p>### Details The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file.</p> <p>### Impact Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.</p> <p>----</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/8653/files</p> https://cve.radiocsirt.org/vuln/ghsa-jwhx-xcg6-8xhj https://cve.radiocsirt.org/vuln/oesa-2024-2254 <p><strong>Affected:</strong> openEuler:24.03-LTS: python-aiohttp</p> <p>Async http client/server framework (asyncio). Security Fix(es): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.(CVE-2024-42367)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: python-aiohttp</p> <p>Async http client/server framework (asyncio). Security Fix(es): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.(CVE-2024-42367)</p> https://cve.radiocsirt.org/vuln/oesa-2024-2254 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14280-1 <p>python310-aiohttp-3.10.5-1.1 on GA media</p> <p>python310-aiohttp-3.10.5-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14280-1 https://cve.radiocsirt.org/vuln/pysec-2026-1108 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Static routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.</p> <p>### Details The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file.</p> <p>### Impact Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.</p> <p>----</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/8653/files</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Static routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.</p> <p>### Details The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file.</p> <p>### Impact Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.</p> <p>----</p> <p>Patch: https://github.com/aio-libs/aiohttp/pull/8653/files</p> https://cve.radiocsirt.org/vuln/pysec-2026-1108 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-42367 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:22.04:LTS: python-aiohttp, Ubuntu:24.04:LTS: python-aiohttp, Ubuntu:25.04: python-aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:22.04:LTS: python-aiohttp, Ubuntu:24.04:LTS: python-aiohttp, Ubuntu:25.04: python-aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-42367 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0809 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0809