A critical path traversal vulnerability in AIM 3.28.0 allows unauthenticated remote attackers to achieve arbitrary file writes, creating a significant risk of system compromise.

This is a path traversal vulnerability located in the restore_run_backup function, which fails to validate paths when extracting data from backup files submitted to the run_instruction API. The vulnerability allows unauthenticated attackers to write arbitrary files to the underlying filesystem.

Successful exploitation allows an attacker to overwrite critical system files or upload malicious scripts, which can lead to remote code execution and full system takeover. Given the CVSS score of 7.0, this represents a high-severity risk that could result in significant data loss, service disruption, and unauthorized access to sensitive environments.

Immediate Action: Review the provided vendor reference and apply the corresponding security patch or update to a version that addresses the path validation flaw in the restore_run_backup function.

Proactive Monitoring: Monitor server logs for suspicious requests directed at the run_instruction API and look for unusual file modification events or unexpected file creation in sensitive directories.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming tar file uploads for directory traversal sequences, such as dot-dot-slash patterns, before they reach the application.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the researcher write-up linked in the references.

The presence of a known proof-of-concept and the high-impact nature of arbitrary file writes necessitate immediate attention. Administrators should prioritize verifying their current AIM version and applying the necessary security updates to prevent unauthorized filesystem access. If an update is not immediately feasible, restrict access to the affected API endpoint to trusted administrative networks.