Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2024-23334

HighExploitedPublic exploit

aiohttp is vulnerable to directory traversal

Published Jan 29, 2024 · Updated Oct 6, 2026 · Also known as DEBIAN-CVE-2024-23334, GHSA-5h86-8mv2-jq9f, PYSEC-2024-24, ROOT-APP-PYPI-CVE-2024-23334, UBUNTU-CVE-2024-23334

Key Facts

Patch immediately
  • CVE-2024-23334 is a high-severity vulnerability (CVSS 8.2 v4) affecting Aiohttp, Fedora (Fedoraproject), py3-aiohttp (alpine) and 15 more products.
  • It is exploited in the wild, listed in Industry KEV feed since Mar 15, 2024 and is known to be used in ransomware campaigns. Public exploit code is available.
  • EPSS estimates a 77% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Aiohttp 1c335944d6a8b1298baf179b7c0b3069f10c514b, Aiohttp 2.3.9+sp999, Aiohttp 3.8.6+aikido.1.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v4

8.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS (30-day exploit likelihood)

77%

Higher than 99.5% of all scored CVEs

Exploited in the wild

Yes

1 catalog listing, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2024-23334 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
Industry KEV feedMar 15, 2024n/aKnown

Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Affected Products

63 affected entries in total
ProductAffected versionsFixed in
AiohttpAiohttp>= 1.0.5, >= < 3.9.23.9.2
FedoraFedoraproject39n/a
py3-aiohttpalpineSee advisory3.9.3-r0
checkovchainguardSee advisory3.0.34-r1
py3.13-scanner-test-libraries-aiohttpchainguardSee advisory0.0.1-r1
13 more affected products in the full CVE brief

Patched Releases

Aiohttp

1c335944d6a8b1298baf179b7c0b3069f10c514b, 2.3.9+sp999, 3.8.6+aikido.1, 3.8.6+aikido.10, 3.8.6+aikido.11, 3.8.6+aikido.12, 3.8.6+aikido.13, 3.8.6+aikido.14, 3.8.6+aikido.2, 3.8.6+aikido.3, 3.8.6+aikido.4, 3.8.6+aikido.5, 3.8.6+aikido.6, 3.8.6+aikido.7, 3.8.6+aikido.8, 3.8.6+aikido.9, 3.9.1+aikido.7, 3.9.1+aikido.8, 3.9.1+aikido.9, 3.9.2

automation-controller

0:4.5.5-2.el8ap, 0:4.5.5-2.el9ap

checkov

3.0.34-r1

py3-aiohttp

3.9.3-r0

py3-cassandra-medusa

0.17.2-r1

py3.13-scanner-test-libraries-aiohttp

0.0.1-r1

python-aiohttp

0:3.9.2-1.el8ui, 0:3.9.3-1.el9ap, 3.0.1-1ubuntu0.1~esm4, 3.6.2-1ubuntu1+esm3, 3.7.4-1+deb11u1, 3.8.1-4ubuntu0.2, 3.8.4-1+deb12u1, 3.9.1-1ubuntu0.1, 3.9.3-150400.10.14.1, 3.9.5-1

python-jinja2

2.7.2-4.el7+sp999

python310-aiohttp

3.9.3-1.1

python311-aiohttp

3.9.3-1.1, 3.9.3-150400.10.14.1

python313-aiohttp

3.14.3-1.1

python314-aiohttp

3.14.3-1.1

python39-aiohttp

3.9.3-1.1

python3x-aiohttp

0:3.9.3-1.el8ap

rootio-aiohttp

3.8.6+root.io.1, 3.8.6+root.io.10, 3.8.6+root.io.2, 3.8.6+root.io.3, 3.8.6+root.io.4, 3.8.6+root.io.5, 3.8.6+root.io.6, 3.8.6+root.io.7, 3.8.6+root.io.8, 3.8.6+root.io.9, 3.9.1+root.io.6, 3.9.1+root.io.7

seal-aiohttp

2.3.9+sp999

seal-python-jinja2

2.7.2-4.el7+sp999

Timeline

  1. Publicly disclosed

    Jan 29, 2024

  2. Added to Industry KEV feed

    Mar 15, 2024

  3. Last updated

    Oct 6, 2026

Weakness Type

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2024-23334 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo