CVE-2024-27306
published 2024-04-18CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.67%
47.8th percentile
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.9.4 | 3.9.4 |
| aiohttp | aiohttp | < 3.9.4 | 3.9.4 |
| aiohttp | aiohttp | >= 0 < 3.9.4 | 3.9.4 |
| debian | python-aiohttp | < python-aiohttp 3.7.4-1+deb11u1 (bullseye) | python-aiohttp 3.7.4-1+deb11u1 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv7.5HIGH
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-aiohttp vulnerabilities
osv·2025-07-17·CVSS 7.5
CVE-2023-47627 [HIGH] python-aiohttp vulnerabilities
python-aiohttp vulnerabilities
Ben Kallus discovered that AIOHTTP did not correctly parse HTTP
headers. A remote attacker could possibly use this issue to perform
request smuggling. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-47627)
Ivan Novikov discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)
Paul J. Dorn discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2024-23829)
Takes
GHSA
aiohttp Cross-site Scripting vulnerability on index pages for static file handling
ghsa·2024-04-18
CVE-2024-27306 [MEDIUM] CWE-79 aiohttp Cross-site Scripting vulnerability on index pages for static file handling
aiohttp Cross-site Scripting vulnerability on index pages for static file handling
### Summary
A XSS vulnerability exists on index pages for static file handling.
### Details
When using `web.static(..., show_index=True)`, the resulting index pages do not escape file names.
If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.
### Workaround
We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.
Other users can disable `show_index` if unable to upgrade.
Patch: https://github.com/aio-libs/aiohttp/pull/8319/files
OSV
CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
osv·2024-04-18·CVSS 6.1
CVE-2024-27306 [MEDIUM] CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
OSV
aiohttp Cross-site Scripting vulnerability on index pages for static file handling
osv·2024-04-18
CVE-2024-27306 [MEDIUM] aiohttp Cross-site Scripting vulnerability on index pages for static file handling
aiohttp Cross-site Scripting vulnerability on index pages for static file handling
### Summary
A XSS vulnerability exists on index pages for static file handling.
### Details
When using `web.static(..., show_index=True)`, the resulting index pages do not escape file names.
If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.
### Workaround
We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.
Other users can disable `show_index` if unable to upgrade.
Patch: https://github.com/aio-libs/aiohttp/pull/8319/files
Ubuntu
AIOHTTP vulnerabilities
vendor_ubuntu·2025-07-17·CVSS 5.3
CVE-2023-49082 [MEDIUM] AIOHTTP vulnerabilities
Title: AIOHTTP vulnerabilities
Summary: Several security issues were fixed in AIOHTTP.
Ben Kallus discovered that AIOHTTP did not correctly parse HTTP
headers. A remote attacker could possibly use this issue to perform
request smuggling. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-47627)
Ivan Novikov discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)
Paul J. Dorn discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 20.04 LTS, Ubunt
Red Hat
aiohttp: XSS on index pages for static file handling
vendor_redhat·2024-04-18·CVSS 6.1
CVE-2024-27306 [MEDIUM] CWE-79 aiohttp: XSS on index pages for static file handling
aiohttp: XSS on index pages for static file handling
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
A flaw was found in aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. When using "web.static(..., show_index=True)", the resulting index pages do not escape file names. If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to cross-site scripting (XSS) attacks.
Package: ansible
Debian
CVE-2024-27306: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2024·CVSS 6.1
CVE-2024-27306 [MEDIUM] CVE-2024-27306: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
Scope: local
bookworm: open
bullseye: resolved (fixed in 3.7.4-1+deb11u1)
forky: resolved (fixed in 3.9.5-1)
sid: resolved (fixed in 3.9.5-1)
trixie: resolved (fixed in 3.9.5-1)
No detection rules found.
No public exploits indexed.
https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397https://github.com/aio-libs/aiohttp/pull/8319https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8ghttps://lists.fedoraproject.org/archives/list/[email protected]/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP/https://lists.fedoraproject.org/archives/list/[email protected]/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U/https://lists.fedoraproject.org/archives/list/[email protected]/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3/https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397https://github.com/aio-libs/aiohttp/pull/8319https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8ghttps://lists.debian.org/debian-lts-announce/2025/02/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP/https://lists.fedoraproject.org/archives/list/[email protected]/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U/https://lists.fedoraproject.org/archives/list/[email protected]/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3/
2024-04-18
Published