CVE-2024-6483: Aim Relative Path Traversal vulnerability

March 20, 2025 (updated March 21, 2025)

A vulnerability in the runs/delete-batch endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploited to delete arbitrary files or directories, potentially causing denial of service or data loss.

References

github.com/advisories/GHSA-p6x3-v6g3-7557
github.com/aimhubio/aim
huntr.com/bounties/dc45d480-e579-4af4-8603-c52ecfd5e363
nvd.nist.gov/vuln/detail/CVE-2024-6483

Code Behaviors & Features

Detect and mitigate CVE-2024-6483 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →