CERT24GHSA-4qcx-jx49-6qrh — Path traversal in Aim's LockManager.release_locksLoading data…
CERT24Threat Observatory
Period

GHSA-4qcx-jx49-6qrh — Path traversal in Aim's LockManager.release_locks

A path traversal vulnerability in Aim's LockManager.release_locks function allows arbitrary file deletion through relative paths. The user-controllable run_hash parameter is concatenated without normalization as part of a path used for file deletion. The vulnerability is exposed through the Repo._close_run() method, which is accessible through the tracking server instruction API.

← Back to intelligence

GHSA-4qcx-jx49-6qrh — Path traversal in Aim's LockManager.release_locks

A path traversal vulnerability in Aim's LockManager.release_locks function allows arbitrary file deletion through relative paths. The user-controllable run_hash parameter is concatenated without normalization as part of a path used for file deletion. The vulnerability is exposed through the Repo._close_run() method, which is accessible through the tracking server instruction API.