CVE-2024-6851: Aimstack Aim Path Traversal Vulnerability

CVE-2024-6851 Overview

CVE-2024-6851 is a path traversal vulnerability [CWE-22] in aimhubio/aim version 3.22.0, an open-source experiment tracking tool for machine learning workflows. The LocalFileManager._cleanup function in the aim tracking server accepts a user-supplied glob pattern to identify files for deletion. The function fails to validate that matched files reside within the directory managed by LocalFileManager. A remote attacker can supply a crafted glob pattern to delete arbitrary files on the host filesystem. Successful exploitation results in loss of availability for the aim tracking server and any co-located data accessible to the server process.

Critical Impact
Unauthenticated remote attackers can delete arbitrary files on systems running aim 3.22.0, causing service disruption and potential data loss.

Affected Products

aimhubio/aim version 3.22.0 (Python package)
Aim tracking server deployments exposing the LocalFileManager API
Downstream MLOps environments embedding the vulnerable release

Discovery Timeline

2025-03-20 - CVE-2024-6851 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6851

Vulnerability Analysis

The vulnerability resides in the LocalFileManager._cleanup method within the aim tracking server. The method accepts a glob pattern from the client and passes it to a file matching routine, then deletes every returned path. The implementation performs no canonicalization or containment check against the manager's base directory. An attacker who can reach the tracking server API can submit patterns such as ../../etc/* or absolute wildcards to expand outside the intended repository. Files matching the pattern are unlinked with the privileges of the aim server process. Because the attack targets availability, the loss depends on which files the server process can write. In typical deployments the server runs with user-level privileges and can remove configuration, logs, experiment artifacts, and other files owned by the same user.

Root Cause

The root cause is missing path containment enforcement in LocalFileManager._cleanup. The function trusts client-supplied glob input and never resolves matched paths against the manager's root directory. This is a classic path traversal weakness classified under [CWE-22]: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker sends a request to the aim tracking server that invokes the cleanup workflow with a malicious glob pattern. The pattern uses traversal sequences or absolute path wildcards to reference files outside the managed directory. The server expands the glob, iterates matches, and deletes each file without validating its location. No verified public proof-of-concept code is available; see the Huntr Bug Bounty Report for the disclosure details.

Detection Methods for CVE-2024-6851

Indicators of Compromise

Unexpected deletion of files outside the aim repository directory owned by the aim server user
HTTP requests to the aim tracking server containing glob patterns with ../ sequences or absolute paths
Aim server logs showing cleanup operations referencing paths outside the configured base directory
Missing experiment metadata, logs, or system configuration files following aim server activity

Detection Strategies

Inspect reverse proxy and application logs for cleanup API calls containing traversal sequences or wildcards outside the aim workspace
Enable filesystem auditing (auditd, Windows Object Access) on directories adjacent to the aim base path to flag deletions by the aim process
Correlate aim server process activity with unlink system calls targeting paths outside the managed directory

Monitoring Recommendations

Alert on any file deletion by the aim server process outside its configured repository root
Monitor aim tracking server exposure to untrusted networks and log all administrative API calls
Track installed aim package versions across ML infrastructure using software inventory tooling

How to Mitigate CVE-2024-6851

Immediate Actions Required

Upgrade aim to a version later than 3.22.0 that includes the path containment fix
Restrict network access to the aim tracking server so only trusted clients can reach the API
Run the aim server as a low-privilege user with filesystem access limited to the experiment directory
Audit recent aim server logs for cleanup requests containing suspicious glob patterns

Patch Information

Refer to the upstream aimhubio/aim repository for release notes addressing this issue. The Huntr Bug Bounty Report documents the vulnerability and remediation guidance. Apply the vendor-supplied update as the primary remediation.

Workarounds

Place the aim tracking server behind an authenticating reverse proxy with strict access control lists
Deploy the aim server in a container or chroot jail with no access to sensitive host paths
Disable or block the cleanup endpoint at the proxy layer until the patched version is deployed
Apply mandatory access control policies (SELinux, AppArmor) restricting the aim process to its data directory

bash

# Configuration example: upgrade aim and restrict server exposure
pip install --upgrade aim

# Bind the tracking server to localhost only
aim server --host 127.0.0.1 --port 53800

# Run under a dedicated low-privilege account with a scoped data directory
sudo -u aim-svc aim server --repo /var/lib/aim/repo