Home » Database

AVID-2026-R1587

Description

Arbitrary File/Directory Deletion in aimhubio/aim (CVE-2024-6483)

Details

A vulnerability in the runs/delete-batch endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploited to delete arbitrary files or directories, potentially causing denial of service or data loss.

Reason for inclusion in AVID: CVE-2024-6483 describes a path traversal vulnerability in aimhubio/aim’s runs/delete-batch endpoint, enabling arbitrary file/directory deletion. The affected component is used in AI experimentation/artifact management, i.e., part of AI pipelines. This aligns with AI-related software and the general-purpose AI software supply chain, and it is a CVE-style security vulnerability with clear exploit potential and evidence.

References

Affected or Relevant Artifacts

  • Developer: aimhubio
  • Deployer: aimhubio
  • Artifact Details:
TypeName
Systemaimhubio/aim

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score5.3
Base Severity🟠 Medium
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability Impact🟢 Low

CWE

IDDescription
CWE-23CWE-23 Relative Path Traversal

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry