Vulnerability · Published Nov 5, 2026 · Assigned by AMZN
CVE-2026-119083GluonTS arbitrary file write during archive extraction
High 7.8
In plain English
A high-severity path traversal in gluonts from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 91.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. To remediate this issue, users should upgrade to version 0.17.0 or later.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/awslabs/gluonts/releases/tag/v0.17.0 release-notes, patch
- https://aws.amazon.com/security/security-bulletins/2026-171-aws/ vendor-advisory
- https://github.com/awslabs/gluonts/security/advisories/GHSA-rg2m-55pr-vp3q third-party-advisory