CVE-2024-6483 - Arbitrary File/Directory Deletion in aimhubio/aim

Back Back to CVE browser

MEDIUM

Arbitrary File/Directory Deletion in aimhubio/aim

Published Mar 20, 2025

5.3

MEDIUM

CVSS 3.0

EPSS 0.87%

Description

A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploited to delete arbitrary files or directories, potentially causing denial of service or data loss.

Affected products

Vendor Aimhubio Product Aimhubio/aim Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=latest

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Aimhubio

Aimhubio/aim

n/a

Version	Status	Constraints
unspecified	affected	<=latest

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-23

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6986
Advisory
https://github.com/advisories/GHSA-p6x3-v6g3-7557
Advisory
https://huntr.com/bounties/dc45d480-e579-4af4-8603-c52ecfd5e363
ExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-6483

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6986		Advisory
https://github.com/advisories/GHSA-p6x3-v6g3-7557		Advisory
https://huntr.com/bounties/dc45d480-e579-4af4-8603-c52ecfd5e363		ExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-6483