{"action":"Upgrade aiohttp to 3.9.2 or later.","affected":[{"fixed":"3.9.2","introduced":"1.0.5"}],"component":"aiohttp","cve_ids":["CVE-2024-23334"],"ecosystem":"PyPI","epss":0.76875,"exploited":false,"fixed_versions":["3.9.2"],"ghsa_id":"GHSA-5h86-8mv2-jq9f","id":"tcs_01M5KF11ZRDZD902HMP050W8SQ","modified_at":"2026-09-10T03:50:04.835842803Z","published_at":"2024-01-29T22:31:03Z","references":["https://osv.dev/vulnerability/GHSA-5h86-8mv2-jq9f","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f","https://nvd.nist.gov/vuln/detail/CVE-2024-23334","https://github.com/aio-libs/aiohttp/pull/8079","https://github.com/aio-libs/aiohttp/pull/8079/files","https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514b","https://github.com/aio-libs/aiohttp","https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2024-24.yaml","https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7","https://www.exploit-db.com/exploits/52474"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-5h86-8mv2-jq9f","url":"https://osv.dev/vulnerability/GHSA-5h86-8mv2-jq9f"}],"summary":"aiohttp is vulnerable to directory traversal"}