CVE-2024-6851

Summary

CVE-2024-6851 is a vulnerability affecting version 3.22.0 of aimhubio/aim. In this version, the LocalFileManager._cleanup function in the aim tracking server is responsible for deleting files based on a user-supplied glob-pattern. However, this function fails to validate that the matched files are confined to the directory managed by the LocalFileManager. Consequently, an attacker can exploit this vulnerability by crafting a malicious glob-pattern to delete arbitrary files outside the intended directory. This can potentially lead to significant data loss or unauthorized access.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.