Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-pyzv-9qst-eucm
Vulnerability ID VCID-pyzv-9qst-eucm
Aliases CVE-2024-6851
GHSA-mrvr-7493-pfq3
Summary In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01241 https://api.first.org/data/v1/epss?cve=CVE-2024-6851
epss 0.01241 https://api.first.org/data/v1/epss?cve=CVE-2024-6851
epss 0.01241 https://api.first.org/data/v1/epss?cve=CVE-2024-6851
cvssv3.1 7.5 https://github.com/aimhubio/aim
generic_textual HIGH https://github.com/aimhubio/aim
cvssv3.1 7.5 https://github.com/aimhubio/aim/blob/88ac143708fad8737094b74e9e5b25689d18f1a6/aim/sdk/reporter/file_manager.py#L44
generic_textual HIGH https://github.com/aimhubio/aim/blob/88ac143708fad8737094b74e9e5b25689d18f1a6/aim/sdk/reporter/file_manager.py#L44
cvssv3 7.5 https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
cvssv3.1 7.5 https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
generic_textual HIGH https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
ssvc Track https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-6851
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-6851
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-6851
https://github.com/aimhubio/aim/blob/88ac143708fad8737094b74e9e5b25689d18f1a6/aim/sdk/reporter/file_manager.py#L44
https://nvd.nist.gov/vuln/detail/CVE-2024-6851
839703fb-23b7-4dc4-ae81-44cd4740d3f3 https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
GHSA-mrvr-7493-pfq3 https://github.com/advisories/GHSA-mrvr-7493-pfq3
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/aimhubio/aim
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/aimhubio/aim/blob/88ac143708fad8737094b74e9e5b25689d18f1a6/aim/sdk/reporter/file_manager.py#L44
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-20T17:52:40Z/ Found at https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-6851
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.79674
EPSS Score 0.01241
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:39:41.313298+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/6xxx/CVE-2024-6851.json 38.6.0