GitHub Advisoryadvisory · PyPI

GHSA-p6x3-v6g3-7557 Aim Relative Path Traversal vulnerability

MEDIUM Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-6483
Ecosystem
PyPI
Packages
aim
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-23
Reviewed
2025-03-21

Affected packages

• PyPI aim: <= 3.19.3 (no fix yet)

Description

A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploited to delete arbitrary files or directories, potentially causing denial of service or data loss.

Related

Alias · CVE (1)

  • CVE-2024-6483 A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through… vulnerability

Weakness · CWE (1)

  • CWE-23 Relative Path Traversal weakness

References