CVE-2024-6851 — Arbitrary File Deletion in aimhubio/aim
In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does …
Published: 2025-03-20 · CVSS: 7.5 · CVSS 3.0
In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7