Threats tagged 'brew-dvc-cve-2024-42367'

A path traversal vulnerability exists in aiohttp versions prior to 3.8.5 when serving static routes with compressed file variants (.gz or .br) that are symbolic links. The server's default protection against path traversal does not apply to these compressed variants, allowing symbolic links to be followed outside the root directory. This can lead to unauthorized file access if such symbolic links point outside the intended directory or if users can create/upload them.