CVE-2021-43775: Aim Path Traversal Vulnerability
Summary
CVE-2021-43775: Aim is an open-source, self-hosted machine learning experiment tracking tool. Affects aim versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Aim is an open-source, self-hosted machine learning experiment tracking tool. It provides functionality for tracking and visualizing machine learning experiments, allowing users to monitor and analyze their models. Aim is commonly used in the Python ecosystem and is available on PyPI. However, versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack.
Vulnerability Detail
The path traversal vulnerability in Aim arises from the improper handling of user-supplied input. By manipulating variables that reference files with '../' sequences or using absolute file paths, an attacker can potentially access arbitrary files and directories stored on the file system. This includes sensitive files such as application source code, configuration files, and critical system files. The vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system. The issue has been addressed in Aim version 3.1.0.
How To Fix
Latest published version: 4.0.3 as of 23 Oct 2026
pip install --upgrade "aim==4.0.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
pip install --upgrade "aim==3.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Aim path traversal vulnerability (CVE-2021-43775) allows an attacker to access arbitrary files and directories on the file system. It is crucial to upgrade to Aim version 3.1.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aim →
FAQ
The vulnerability allows an attacker to access arbitrary files and directories on the file system, potentially leading to unauthorized access, data leakage, and compromise of the system.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to Aim version 3.1.0 or later.
No, only versions of Aim prior to 3.1.0 are affected. Aim version 3.1.0 and later include the necessary fixes to address the vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your Aim installation is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this specific vulnerability.
You can find more information about this vulnerability, including the technical details and the fix, in the Aim advisory on the PyPA Advisory Database: https://github.com/pypa/advisory-database/blob/main/vulns/aim/PYSEC-2021-839.yaml
Related vulnerabilities
Recent vulnerabilities recorded for aim.
