High severity8.6NVD Advisory· Published Nov 23, 2021· Updated Jun 17, 2026
CVE-2021-43775
CVE-2021-43775
Description
Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
aimPyPI | < 3.1.0 | 3.1.0 |
Affected products
2Patches
Vulnerability mechanics
References
9- github.com/aimhubio/aim/pull/1003nvdPatchThird Party AdvisoryWEB
- github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738nvdPatch
- github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjccnvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-8phj-f9w2-cjccghsaADVISORY
- github.com/aimhubio/aim/issues/999nvdIssue TrackingThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-43775ghsaADVISORY
- github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.pynvdProductWEB
- github.com/aimhubio/aim/commit/b9e53df5e32d14bbd3a2c738e2db7187fb531e93ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/aim/PYSEC-2021-839.yamlghsaWEB
News mentions
0No linked articles in our index yet.