Path Traversal Vulnerability in GluonTS Archive Extraction Utility
CVE-2026-119083

8.4HIGH

Key Information:

Vendor

Aws

Status
Gluonts
Vendor
CVE Published:
5 November 2026

What is CVE-2026-119083?

A path traversal vulnerability exists in the archive extraction utility of GluonTS prior to version 0.17.0. An attacker can exploit this flaw by providing a specially crafted tar archive that may enable them to write arbitrary files outside the designated extraction directory. This is achieved through the use of symbolic or hard links embedded in the archive, posing a potential risk to the system's integrity. Users are strongly advised to upgrade to version 0.17.0 or later to mitigate this issue.

Affected Version(s)

gluonts 0 < 0.17.0

References

https://github.com/awslabs/gluonts/releases/tag/v0.17.0
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/awslabs/gluonts/security/advisories/GH...
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.