CVE-2025-69226

MediumCVSS 5.3/10Last modified Oct 11, 2026

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22 CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 5, 2026
Last modified: Oct 11, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-692277.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occu CVE-2025-692287.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in s CVE-2025-692295.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages c CVE-2025-69235.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software UNIS allows Ref CVE-2025-692305.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cooki CVE-2025-692315.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a stored cr CVE-2025-692327.5free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, correspon CVE-2025-692335.3Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, u CVE-2025-692349.1Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.CVE-2025-692357.5Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.CVE-2025-692365.4Raytha CMS is vulnerable to Stored XSS via FieldValues[1].Value parameter in post editing functionality. Authenticated attacker with permiss CVE-2025-692375.4Raytha CMS is vulnerable to Stored XSS via FieldValues[0].Value parameter in page creation functionality. Authenticated attacker with permis