CVE-2024-27306

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-27306

Severity

6.1

Medium

CVSS V3

Summary

aiohttp vulnerable to XSS on index pages for static file handling

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable show_index if unable to upgrade.