CVE-2024-6851

published 2025-03-20

CVE-2024-6851: In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files…

Priority P3 45 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I N A H

In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
aimhubio	aimhubio_aim	unspecified – latest	—
aimstack	aim	—	—
aimstack	aim	0 – 3.22.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22