CVE-2024-23334
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
- Published
- Jan 29, 2024
- Updated
- Feb 4, 2026
- Assigning CNA
- GitHub_M
- Evidence observed
- Feb 4, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NHigh · next 30 days
- Percentile
- 99.5%
- Model date
- Oct 19, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Sources
python/CVE-2024-23334
aiohttp Directory Traversal Vulnerability (CVE-2024-23334)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/aiohttp:3.9.1(python/CVE-2024-23334/docker-compose.yml:services.aiohttp-app.image)
- aiohttp - Directory TraversalTemplate
http/cves/2024/CVE-2024-23334.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: regex,status,word($.matchers[*].type)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.