CVE-2024-6851: Path Traversal in aimhubio/aim

The vulnerability lies in the LocalFileManager._cleanup function, which is responsible for deleting files based on a user-provided glob-pattern. The function fails to properly validate that the matched files reside within the intended directory. Consequently, an attacker can supply a carefully crafted glob-pattern that targets files outside of the managed directory, leading to arbitrary file deletion on the server. This could result in data loss, system instability, or even complete compromise of the system if critical configuration files or binaries are deleted. The potential impact is significant, especially in environments where aimhubio/aim is used to manage sensitive tracking data.

1. Reserved2024-07-17
2. Published2025-03-20
3. Modified2025-03-21
4. EPSS updated2026-04-02

While a patched version is pending, immediate mitigation steps can be taken. First, restrict access to the LocalFileManager.cleanup function to trusted users only. Implement strict input validation on the glob-pattern, ensuring it only matches files within the intended directory. Consider using a more secure file deletion mechanism that explicitly verifies file paths before deletion. As a temporary workaround, disable the file cleanup functionality entirely if it is not essential. Monitor system logs for any suspicious file deletion activity. After a patched version is released, upgrade immediately and confirm by verifying that the LocalFileManager.cleanup function now correctly validates file paths.