{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/aiohttp--3.9.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.9,"id":"CVE-2024-23334"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["aiohttp (\u003c 3.9.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2024-23334 is a path traversal vulnerability affecting aiohttp versions earlier than 3.9.2. An attacker can exploit this vulnerability by uploading a compressed archive containing a symbolic link that points to sensitive files, such as /etc/shadow. This allows the attacker to read arbitrary files on the system outside of the intended directory. Publicly available exploit scripts are currently circulating, which automate the discovery of vulnerable hosts and attempt exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized read access to arbitrary files on the filesystem, potentially exposing sensitive system information or credentials depending on the application context and permissions of the service running aiohttp.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade aiohttp to version 3.9.2 or later to mitigate the vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement strict validation on uploaded file contents and reject archives containing symbolic links.\u003c/li\u003e\n\u003cli\u003eIdentify all internet-facing services utilizing the aiohttp library and prioritize patching for those instances.\u003c/li\u003e\n\u003cli\u003eMonitor web application logs for file upload requests containing path traversal sequences or attempts to traverse outside of designated upload directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T09:07:36Z","date_published":"2026-10-24T09:07:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aiohttp-path-traversal/","summary":"CVE-2024-23334 is a path traversal vulnerability in aiohttp versions prior to 3.9.2 that allows attackers to access arbitrary files via malicious file uploads.","title":"aiohttp: Path traversal vulnerability (CVE-2024-23334)","url":"https://feed.craftedsignal.io/briefs/2026-10-aiohttp-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Aiohttp (\u003c 3.9.2)","version":"https://jsonfeed.org/version/1.1"}