CVE-2021-43775

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-437766.1Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick CVE-2021-437776.1Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) inc CVE-2021-437787.5Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin insta CVE-2021-437799.9GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 su CVE-2021-43785.4The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to CVE-2021-437808.8Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON CVE-2021-437814.3Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resou CVE-2021-437827.2Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-CVE-2021-437838.5@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor wit CVE-2021-437845.0runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a CVE-2021-437856.1@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL f CVE-2021-437867.5Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintenti