CVE-2021-43775

Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.

• CWE-22
• CWE-22

• https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16Product
• https://github.com/aimhubio/aim/issues/999Issue Tracking, Third Party Advisory
• https://github.com/aimhubio/aim/pull/1003Patch, Third Party Advisory
• https://github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738Patch
• https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjccExploit, Third Party Advisory
• https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16Product
• https://github.com/aimhubio/aim/issues/999Issue Tracking, Third Party Advisory
• https://github.com/aimhubio/aim/pull/1003Patch, Third Party Advisory
• https://github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738Patch
• https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjccExploit, Third Party Advisory

Published

Nov 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43767Odyssey passes to client unencrypted bytes from man-in-the-m…5.9
• CVE-2021-43768In Malwarebytes For Teams v.1.0.990 and before and fixed in …5.3
• CVE-2021-4377The Doneren met Mollie plugin for WordPress is vulnerable to…6.5
• CVE-2021-43771Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnera…7.8
• CVE-2021-43772Trend Micro Security 2021 v17.0 (Consumer) contains a vulner…5.5
• CVE-2021-43774A risky-algorithm issue was discovered on Fujifilm DocuCentr…4.9
• CVE-2021-43776Backstage is an open platform for building developer portals…6.1
• CVE-2021-43777Redash is a package for data visualization and sharing. In R…6.1
• CVE-2021-43778Barcode is a GLPI plugin for printing barcodes and QR codes.…7.5
• CVE-2021-43779GLPI is an open source IT Asset Management, issue tracking s…9.9
• CVE-2021-4378The WP Quick FrontEnd Editor plugin for WordPress is vulnera…5.4
• CVE-2021-43780Redash is a package for data visualization and sharing. In v…8.8