CVE-2024-6851

In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:aimstack:aim:3.22.0:*:*:*:*:python:*:*

History

23 Jul 2025, 20:57

Type	Values Removed	Values Added
References	~~() https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3 -~~	() https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3 - Exploit, Third Party Advisory
Summary		(es) En la versión 3.22.0 de aimhubio/aim, la función LocalFileManager._cleanup del servidor de seguimiento de AIM acepta un patrón glob especificado por el usuario para eliminar archivos. Esta función no verifica que los archivos coincidentes se encuentren en el directorio administrado por LocalFileManager, lo que permite que un patrón glob manipulado con fines maliciosos provoque la eliminación arbitraria de archivos.
CPE		cpe:2.3:a:aimstack:aim:3.22.0:::::python::
First Time		Aimstack aim Aimstack

20 Mar 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-20 10:15

Updated : 2025-07-23 20:57

NVD link : CVE-2024-6851

Mitre link : CVE-2024-6851

CVE.ORG link : CVE-2024-6851

JSON object : View

Products Affected

aimstack

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

7.5 /10