💣Exploit CVE-2024-8769 - Aimhubio Aim File Deletion Vulnerability (Arbitrary File Deletion)

[Mental_Outlaw]

CVE ID : CVE-2024-8769
Published : March 20, 2025, 10:15 a.m. | 1 hour, 44 minutes ago
Description : A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The `run_hash` parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the `Repo._close_run()` method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Reply if you wish me to write a poc tools of this exploit for you.