Arbitrary File Deletion Vulnerability in Aimhubio's Tracking Server

CVE-2024-6851

Summary

In version 3.22.0 of aimhubio's aim, the LocalFileManager._cleanup function permits the use of user-defined glob patterns for file deletion. This design flaw allows attackers to specify malicious glob patterns that can result in the deletion of files outside the designated directory managed by LocalFileManager. The lack of validation ensures that unauthorized and potentially destructive file operations can be executed, posing significant risks to the integrity and availability of data.

References