high7.5
CVE-2024-6851
Aim Path Traversal vulnerability
Impact
In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | aim | <= 3.22.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aimstack | Aim | Version 3.22.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
- https://github.com/advisories/GHSA-mrvr-7493-pfq3
- https://nvd.nist.gov/vuln/detail/CVE-2024-6851
- https://github.com/aimhubio/aim/blob/88ac143708fad8737094b74e9e5b25689d18f1a6/aim/sdk/reporter/file_manager.py#L44