$ cve CVE-2024-23334 JSON

CVE-2024-23334 EXPLOIT

5.9

MEDIUM · CVSS 3.1 · EPSS 76.9% (pctl 100)

Patch early

A public exploit exists.

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.

Scoring

CVSS	5.9 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS	76.88% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-22
On CISA KEV	no
Public exploit	yes
Published	2024-01-29
Last modified	2026-06-17

Affected (2)

Vendor	Product
aiohttp	aiohttp
fedoraproject	fedora

Public exploits

Source	Title	Date
exploit-db	aiohttp 3.9.1 - directory traversal PoC	2026-02-04

References

→ the Explorer · watch your stack · NVD