CVE-2024-8769: Aim path traversal in LockManager.release_locks
A vulnerability in the LockManager.releaselocks function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The runhash parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion.
Published Mar 20, 2025
Affected packages
aim
- Ecosystem
- PyPI
- Affected
- >= 3.15.0, <= 3.27.0
- Fixed in
- No patched version yet
- Check
pip show aim
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A vulnerability in the LockManager.release_locks function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The run_hash parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the Repo._close_run() method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology