CVE-2024-6851High· 7.5▾ TwilightAim Path Traversal vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.0%
1.0% → 1.0%
In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.
aim <= 3.22.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-2195Critical· 9.8Aim Web API vulnerable to Remote Code Execution
CVE-2024-8769Critical· 9.1Aim path traversal in LockManager.release_locks
CVE-2024-12777Medium· 5.9Aim vulnerable to Synchronous Access of Remote Resource without Timeout
CVE-2024-8238Medium· 5.9Aim Improper Access Control
CVE-2024-8863Low· 3.5Aim Stored XSS through TEXT EXPLORER
CVE-2024-6578Medium· 6.1Aim Stored Cross-site Scripting Vulnerability