High severityNVD Advisory· Published Mar 20, 2025· Updated Mar 20, 2025

Arbitrary File Deletion in aimhubio/aim

CVE-2024-6851

Description

In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
aimPyPI	<= 3.22.0	—

Affected products

ghsa-coords
pkg:pypi/aim
Range: <= 3.22.0
aimhubio/aimhubio/aimv5
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-mrvr-7493-pfq3ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-6851ghsaADVISORY
github.com/aimhubio/aim/blob/88ac143708fad8737094b74e9e5b25689d18f1a6/aim/sdk/reporter/file_manager.pyghsaWEB
huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000