Static file path traversal

Test method

Focused AI review of the vulnerable file with cross-family verification. The curated detection record includes a digest for holders of the original report.

Mode

focused

Finding status

needs_human

Location

web_urldispatcher.py:666

Public detection evidence snapshot

StaticResource._handle skips containment validation when follow_symlinks=True, identified at web_urldispatcher.py:666.

codex: plausible. The excerpt supports the path traversal hypothesis; remote exploitability remains unverified.

Finder

claude (Anthropic alias)

Verifier and verdict

codex (OpenAI alias): plausible

Tool version

Not recorded in historical report (schema v2)

Model versions

Exact model versions not recorded; aliases only

Historical scope

Single file: web_urldispatcher.py; focused deep AI review; no truncation recorded

Rerun detection

Install the Vettalon CLI and configure your models and credentials in config.toml. These steps isolate the vulnerable file for focused review. Model and rule versions may differ; identical results are not guaranteed. Deep mode sends source and context to configured models. This is detection only; it does not run the upstream application or verify exploitation.

git clone --branch v3.9.1 --depth 1 https://github.com/aio-libs/aiohttp.git aiohttp-case
mkdir -p aiohttp-focused
cp aiohttp-case/aiohttp/web_urldispatcher.py aiohttp-focused/
vettalon scan ./aiohttp-focused --profile deep --config ./config.toml --max-modules 8 --cross-check-top 8 --report ./aiohttp-result.json --no-prior

Verifiable original-report excerpt

The excerpt preserves the original finding and any valid review text. The original report is not public. Its digest differs from the excerpt digest; curation is not a signature, vulnerability confirmation or trusted execution proof. The tag and line reference does not establish historical source bytes.

Original scan run status

complete

Limits and prerequisites

A detection match does not establish exploitability or whole-repository recall. Exposure depends on static route configuration.

Sources and attribution

Original reporter and remediation credits belong to the aiohttp advisory. Vettalon performed a historical detection test.