What’s Vulnerable › Vulnerabilities

CVE-2021-43775: Arbitrary file reading vulnerability in Aim

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-23 · updated 2026-06-17
• Weakness: CWE-22

Description

Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.

Affected products

• aimhubio/aim: before 3.1.0 — fixed in 3.1.0

How to fix

Upgrade to a fixed version: aimhubio/aim 3.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16
• https://github.com/aimhubio/aim/issues/999
• https://github.com/aimhubio/aim/pull/1003
• https://github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738
• https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc
• https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16
• https://github.com/aimhubio/aim/issues/999
• https://github.com/aimhubio/aim/pull/1003
• https://github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738
• https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc

Get alerted when CVE-2021-43775 or the next vulnerability affects your stack