Relative Path Traversal Vulnerability in AWS ParallelCluster CLI

CVE-2026-124033

What is CVE-2026-124033?

The AWS ParallelCluster CLI prior to version 3.16.0 has a vulnerability related to relative path traversal within its export-cluster-logs and export-image-logs commands. This flaw allows an authenticated remote user, who has write access to the associated log export Amazon S3 bucket, to exploit a crafted S3 object key. As a result, the attacker could write files outside the designated export directory on the host machine executing the commands. The created files would have user-controlled names and content, potentially leading to sensitive data exposure or unauthorized access. Users are urged to upgrade to version 3.16.0 or later to mitigate this vulnerability.

References