CVE-2024-8769: Path Traversal in aimhubio/aim

The LockManager.releaselocks function in aimhubio/aim is vulnerable to path traversal due to improper handling of the runhash parameter. This parameter, directly influenced by user input, is concatenated into a file path without proper sanitization. Consequently, an attacker can craft malicious requests to the Repo.closerun() method, accessible through the tracking server’s instruction API, to delete any file on the server's file system. This includes critical configuration files, logs, or even system binaries, potentially leading to complete system takeover. The ability to delete arbitrary files significantly expands the attack surface and increases the potential for severe consequences.

1. Reserved2024-09-12
2. Published2025-03-20
3. Modified2025-10-15
4. EPSS updated2026-04-02

While a patched version of aimhubio/aim is the recommended solution, immediate mitigation steps can be taken. First, restrict access to the tracking server instruction API to only authorized users and systems. Implement strict input validation on the run_hash parameter to prevent the injection of relative path components. Consider using a Web Application Firewall (WAF) to filter out malicious requests containing path traversal attempts. Regular monitoring of file system activity for unexpected deletions is also crucial. After upgrading, verify the fix by attempting a path traversal attack via the tracking server API and confirming that file deletion is prevented.