{"id":"CVE-2024-8769","kind":"vulnerability","aliases":["CVE-2024-8769","GHSA-4qcx-jx49-6qrh"],"related":[],"title":"Aim path traversal in LockManager.release_locks","description":"A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The `run_hash` parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the `Repo._close_run()` method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.","summary":"Aim's LockManager.release_locks builds a file path from a user-supplied run_hash without normalization, so relative path sequences escape the intended directory. An attacker who can reach the Aim tracking server's instruction API can delete any file the server process can remove.","severity":"critical","cvss":9.1,"epss":0.00927,"exploited":false,"exploited_at":null,"products":[{"name":"aim","fixed":[],"affected":">= 3.15.0, <= 3.27.0","ecosystem":"pypi"},{"name":"aimstack aim","fixed":["3.24.0"],"affected":"< 3.24.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["aim","cwe-22","cwe-29","ml-tracking","package","python","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Run `pip show aim` and check whether the installed version is between `3.15.0` and `3.27.0` inclusive.\n- Check whether the tracking server (`aim up`) is reachable from untrusted networks.","fix":"- Upgrade the `aim` package to a version newer than `3.27.0` (fixed version not stated in the sources; check the GHSA advisory).\n- Restrict network access to the Aim tracking server until upgraded.","status":"open","published_at":"2025-03-20T10:15:44+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","triaged_at":"2026-10-26T21:08:25+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T21:08:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `aim` package to a version newer than `3.27.0` (fixed version not stated in the sources; check the GHSA advisory).\n- Restrict network access to the Aim tracking server until upgraded.","reach":"network","title":"Aim: path traversal in tracking server lets attackers delete arbitrary files","impact":"high","summary":"Aim's LockManager.release_locks builds a file path from a user-supplied run_hash without normalization, so relative path sequences escape the intended directory. An attacker who can reach the Aim tracking server's instruction API can delete any file the server process can remove.","category":"package","nicknames":[],"who_cares":["aim","python","self-hosted","ml-tracking"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker deletes arbitrary files on the tracking server machine.","analyst_note":"Confirm the fixed version and whether authentication is required for the instruction API, using https://github.com/advisories/GHSA-4qcx-jx49-6qrh.","how_to_check":"- Run `pip show aim` and check whether the installed version is between `3.15.0` and `3.27.0` inclusive.\n- Check whether the tracking server (`aim up`) is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running the Aim tracking server in the affected version range, especially if it listens on a network interface other than localhost. Teams that only use the Aim Python client locally without running the tracking server are not exposed through this path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000631,"input_tokens":3439,"output_tokens":574,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':8A,16A '-22':23B '-29':25B '-8769':9A,17A '4qcx':12A '6qrh':14A 'access':133C 'aim':1A,18A,20A,21B,34B,65B 'aimhubio/aim':88C 'aimstack':19A 'allow':91C 'api':70B,139C 'arbitrari':93C,151C 'attack':60B,144C 'bb76afe':90C 'build':38B 'commit':89C 'concaten':110C 'control':108C 'cve':7A,15A 'cwe':22B,24B 'delet':72B,95C,122C,149C 'directori':58B 'escap':55B 'exploit':146C 'expos':126C 'file':40B,74B,94C,121C,152C 'function':86C 'ghsa':11A 'ghsa-4qcx-jx49-6qrh':10A 'hash':48B,102C 'host':33B 'instruct':69B,138C 'intend':57B 'jx49':13A 'lock':6A,37B,85C 'lockmanager.release':5A,36B,84C 'machin':155C 'method':130C 'ml':27B 'ml-track':26B 'normal':50B,112C 'packag':29B 'paramet':103C 'part':114C 'path':2A,41B,53B,98C,117C 'process':77B 'python':30B 'reach':63B 'relat':52B,97C 'remov':79B 'repo._close_run':129C 'result':142C 'run':47B,101C,156C 'self':32B 'self-host':31B 'sequenc':54B 'server':67B,76B,137C,159C 'specifi':120C 'suppli':46B 'track':28B,66B,136C,158C 'travers':3A,99C 'use':118C 'user':45B,107C 'user-control':106C 'user-suppli':44B 'via':134C 'vulner':81C,124C 'without':49B,111C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Aim tracking server in the affected version range, especially if it listens on a network interface other than localhost. Teams that only use the Aim Python client locally without running the tracking server are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:44+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4qcx-jx49-6qrh","url":"https://github.com/advisories/GHSA-4qcx-jx49-6qrh","severity":"critical","published_at":"2025-03-20T12:32:48+00:00","modified_at":"2026-10-26T20:54:55+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","fetched_at":"2026-10-26T20:56:17+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-8769","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8769","severity":null,"published_at":"2025-03-20T10:15:44+00:00","modified_at":"2026-06-17T08:23:16+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}