Vulnerability Database
289,697
Total vulnerabilities in the database
CVE-2024-8769
A vulnerability in the LockManager.release_locks function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The run_hash parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the Repo._close_run() method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.
| Software | From | Fixed in |
|---|---|---|
aim
|
3.15.0 | 3.27.0.x |
| aimstack / aim | - | 3.24.0 |