{
  "id": "aiohttp-cve-2024-23334",
  "publication": "public",
  "reviewedAt": "2026-10-16",
  "type": "historical",
  "status": "detected",
  "package": "aiohttp",
  "ecosystem": "PyPI",
  "title": {
    "zh": "靜態檔案路徑穿越",
    "en": "Static file path traversal"
  },
  "summary": {
    "zh": "啟用 follow_symlinks 時，靜態資源缺少目錄範圍檢查，可能讀到靜態根目錄外的檔案。",
    "en": "Static resource handling with follow_symlinks enabled can expose files outside the static root."
  },
  "cve": "CVE-2024-23334",
  "ghsa": "GHSA-5h86-8mv2-jq9f",
  "cwe": "CWE-22",
  "sourceVersion": "v3.9.1",
  "fixedVersion": "3.9.2",
  "sourceUrl": "https://github.com/aio-libs/aiohttp/blob/v3.9.1/aiohttp/web_urldispatcher.py",
  "advisoryUrl": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f",
  "fixUrl": "https://github.com/aio-libs/aiohttp/pull/8079/files",
  "publishedAt": "2024-01-29",
  "boundary": {
    "zh": "歷史聚焦掃描識別命中 web_urldispatcher.py:666，最終為 needs_human。未執行 HTTP 利用或修補版本對照。",
    "en": "Historical focused scan matched web_urldispatcher.py:666, ending at needs_human. No HTTP exploit or fixed-version comparison was executed."
  },
  "method": {
    "zh": "將 v3.9.1 的脆弱檔納入聚焦 AI 審查，交由不同家族模型覆核。可下載經整理的識別紀錄；原始檔雜湊供持有原報告者比對。",
    "en": "Focused AI review of the vulnerable file with cross-family verification. The curated detection record includes a digest for holders of the original report."
  },
  "limitations": {
    "zh": "識別命中不能證明可利用性或整庫召回。只在啟用特定靜態路由設定時受影響。",
    "en": "A detection match does not establish exploitability or whole-repository recall. Exposure depends on static route configuration."
  },
  "credit": {
    "zh": "原始發現者與修補者請見 aiohttp 公告 Credits；Vettalon 僅做歷史識別測試。",
    "en": "Original reporter and remediation credits belong to the aiohttp advisory. Vettalon performed a historical detection test."
  },
  "detection": {
    "mode": "focused",
    "findingStatus": "needs_human",
    "file": "web_urldispatcher.py",
    "line": 666,
    "observedAt": "2026-10-12",
    "claim": {
      "zh": "StaticResource._handle 在 follow_symlinks=True 時略過目錄範圍檢查；識別位置為 web_urldispatcher.py:666。",
      "en": "StaticResource._handle skips containment validation when follow_symlinks=True, identified at web_urldispatcher.py:666."
    },
    "reviewerConclusion": {
      "zh": "codex：plausible。片段支援路徑穿越假設，遠端可利用性仍待驗證。",
      "en": "codex: plausible. The excerpt supports the path traversal hypothesis; remote exploitability remains unverified."
    },
    "finder": "claude (Anthropic alias)",
    "reviewer": "codex (OpenAI alias): plausible",
    "toolVersion": "Not recorded in historical report (schema v2)",
    "modelVersions": "Exact model versions not recorded; aliases only",
    "scope": "Single file: web_urldispatcher.py; focused deep AI review; no truncation recorded",
    "rerun": "git clone --branch v3.9.1 --depth 1 https://github.com/aio-libs/aiohttp.git aiohttp-case\nmkdir -p aiohttp-focused\ncp aiohttp-case/aiohttp/web_urldispatcher.py aiohttp-focused/\nvettalon scan ./aiohttp-focused --profile deep --config ./config.toml --max-modules 8 --cross-check-top 8 --report ./aiohttp-result.json --no-prior",
    "sha256": "031e2f8893a9fd7f98086e4198334864286ff87e2e999841e3caea176f85a388"
  },
  "dossier": {
    "artifactPath": "/evidence/dossiers/aiohttp-cve-2024-23334.json",
    "sha256": "b70361afe9a0f600e09718766a069d739202b047d75d2e9b617733f11c507588",
    "runStatus": "complete",
    "incompleteReason": null
  },
  "timeline": [
    {
      "date": "2024-01-29",
      "event": {
        "zh": "上游公開公告與修補版本",
        "en": "Upstream advisory published"
      }
    },
    {
      "date": "2026-10-12",
      "event": {
        "zh": "聚焦識別測試，待人工確認",
        "en": "Focused detection; human review required"
      }
    },
    {
      "date": "2026-10-16",
      "event": {
        "zh": "公開來源與紀錄邊界核對",
        "en": "Public sources and evidence boundary reviewed"
      }
    }
  ]
}