CVE-2025-51463

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-51463
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-51463.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-51463
Published
2025-07-22T16:15:30.510Z
Modified
2026-04-10T05:29:20.814987Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
Summary
[none]
Details

Path Traversal in restorerunbackup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the run_instruction API, which is extracted without path validation during restoration.

References

Affected packages

Git / github.com/aimhubio/aim

Affected ranges

Type
GIT
Repo
https://github.com/aimhubio/aim
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e02b98bac3d287907e166b5a9b65a50eecc73e86
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.28.0"
        }
    ]
}

Affected versions

Other
pre-launch
v0.*
v0.1.0
v0.1.1
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.2.7rc1
v2.*
v2.1.6
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.7.0
v3.*
v3.0.0
v3.0.0-beta5
v3.0.0-beta6
v3.0.1
v3.0.2
v3.1.0
v3.1.1
v3.17.0
v3.17.1
v3.17.2
v3.17.3
v3.17.4
v3.17.5
v3.18.1
v3.19.0
v3.19.1
v3.2.0
v3.20.1
v3.21.0
v3.22.0
v3.23.0
v3.24.0
v3.25.0
v3.25.1
v3.26.1
v3.27.0
v3.28.0
v3.3.0
v3.3.1
v3.3.2
v3.4.0
v3.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-51463.json"