CVE Daily

CVE-2025-51463

Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to ...

High CVSS 7.0

Overview

Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the run_instruction API, which is extracted without path validation during restoration.

CWE: CWE-22 Published: 2025-07-22T16:15:30.510
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 7.0 (HIGH)
  • Detected tags: path (tag impact: MODERATE)

Recommended actions:

  • Canonicalize path; block `..` traversal; use allowlists.

Recommended tools

Tags