CVE-2024-27306

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.

• CWE-79
• CWE-80

• https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397Patch
• https://github.com/aio-libs/aiohttp/pull/8319Issue Tracking
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8gVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3/Mailing List
• https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397Patch
• https://github.com/aio-libs/aiohttp/pull/8319Issue Tracking
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8gVendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3/Mailing List

Published

Apr 18, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27300phpMyFAQ is an open source FAQ web application for PHP 8.1+ …5.4
• CVE-2024-27301Support App is an opensource application specialized in mana…7.3
• CVE-2024-27302go-zero is a web and rpc framework. Go-zero allows user to s…9.1
• CVE-2024-27303electron-builder is a solution to package and build a ready …7.3
• CVE-2024-27304pgx is a PostgreSQL driver and toolkit for Go. SQL injection…9.8
• CVE-2024-27305aiosmtpd is a reimplementation of the Python stdlib smtpd.py…5.3
• CVE-2024-27307JSONata is a JSON query and transformation language. Startin…9.8
• CVE-2024-27308Mio is a Metal I/O library for Rust. When using named pipes …9.1
• CVE-2024-27309While an Apache Kafka cluster is being migrated from ZooKeep…7.4
• CVE-2024-2731Users with low privileges (all permissions deselected in the…5.4
• CVE-2024-27310Zoho ManageEngine ADSelfService Plus versions below 6401 are…6.5
• CVE-2024-27311Zohocorp ManageEngine DDI Central versions 4001 and prior we…8.8