All vulnerabilities
CVE-2024-27306
aiohttp Cross-site Scripting vulnerability on index pages for static file handling
Description
Summary
A XSS vulnerability exists on index pages for static file handling.
Details
When using web.static(..., show_index=True), the resulting index pages do not escape file names.
If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.
Workaround
We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.
Other users can disable show_index if unable to upgrade.
Patch Available
Fix available through Seal Security.
No upgrade required, protect your application instantly.
Fix without upgrading
Score
6.1
Severity
Medium
Ecosystem
Python
Publish Date
April 18, 2024
Modified Date
February 3, 2026
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Versions
