CVE-2024-6483 Arbitrary File/Directory Deletion in aimhubio/aim

What is CVE-2024-6483?

CVE-2024-6483 is a medium-severity path traversal vulnerability in aimhubio/aim, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploited to delete arbitrary files or directories, potentially causing denial of service or data loss.

Weakness: CWE-23

Which versions are affected by CVE-2024-6483?

3 open source packages ship an affected version, including aim. It affects 1 product.

Products include Aimstack Aim.

How do I fix CVE-2024-6483?

No fix has been published for CVE-2024-6483 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-6483 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6483 exists.

Other vulnerabilities in aimhubio/aim

• CVE-2024-6396 Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim Critical 9.8
• CVE-2024-2195 Remote Code Execution in aimhubio/aim Critical 9.8
• CVE-2024-6829 Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim Critical 9.1
• CVE-2024-8769 Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim Critical 9.1
• CVE-2025-51464 Aim vulnerable to Cross-site Scripting High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p6x3-v6g3-7557, PYSEC-2026-1091.