Description
Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive.



To remediate this issue, users should upgrade to version 0.17.0 or later.
Published: 2026-11-05
Score: 8.4 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 16:45:00 +0000

Type Values Removed Values Added
Description Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. To remediate this issue, users should upgrade to version 0.17.0 or later.
Title GluonTS arbitrary file write during archive extraction
First Time appeared Aws
Aws gluonts
Weaknesses CWE-22
CPEs cpe:2.3:a:aws:gluonts:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws gluonts
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Aws Gluonts
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-11-05T16:40:56.542Z

Reserved: 2026-10-29T13:17:46.050Z

Link: CVE-2026-119083

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses