GluonTS flaw CVE-2026-119083 lets crafted tar archives write files outside the extraction directory
VULNERABILITYCVE-2026-119083redteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
CVE-2026-119083 is an arbitrary file write issue in the archive extraction utility of GluonTS, an open-source Python library for probabilistic time series modelling, in versions before 0.17.0. A crafted tar archive containing symbolic or hard links can write files outside the intended extraction directory, with the privileges of the extracting process.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Upgrade GluonTS to version 0.17.0 or later.
- Avoid extracting tar archives from untrusted sources in environments that run GluonTS until the update is applied.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
AWS Security Bulletins