AIOHTTP’s static resource handler on Windows can unintentionally expose NTLMv2 credentials and local file contents when receiving a UNC path. This server‑side request forgery allows an attacker to retrieve authentication tokens or read files from the server, compromising confidential information. The vulnerability arises from the handling of static files under Windows paths and does not require elevated privileges on the target server.

The issue affects the aio-libs aiohttp package in all releases prior to version 3.13.4. The patch is delivered in the 3.13.4 release and later, so any deployments running an older version are vulnerable.

The CVSS score is 6.6, indicating a moderate impact. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog. Exploitation appears to require network access to the server and the ability to control the request URL to the static resource handler. If an attacker can manipulate the URL, they can trigger the credential or file disclosure. The risk is considered moderate but should be mitigated promptly.