Threats tagged 'brew-vdirsyncer-cve-2025-69226'

CVE-2025-69226 is a medium severity path traversal vulnerability in aiohttp versions prior to 3.13.3, an asynchronous HTTP client/server framework for Python. The flaw allows attackers to infer the existence of absolute path components via the path normalization logic used for serving static files, specifically when using the web.static() method, which is not recommended for production. Exploitation does not require authentication or user interaction and can leak information about the file system structure, potentially aiding further attacks. The vulnerability has a CVSS 4.0 base score of 6.3, indicating moderate risk. No known exploits are currently reported in the wild.