Vulnerability · 1 source · latest 48m

GluonTS flaw CVE-2026-119083 lets crafted tar archives write files outside the extraction directory

VULNERABILITYCVE-2026-119083redteam/daily · 1 source

Severity: Medium
Highest CVSS: 8.4
Exploited: Not known
Sources: 1

What happened

CVE-2026-119083 affects GluonTS, the Python time series library, in all versions before 0.17.0 (AWS bulletin 2026-171-AWS, published 11/05/2026). The archive extraction utility does not stop a crafted tar archive with symbolic or hard links from writing files outside the intended extraction directory, using the privileges of the extracting process. Defenders should upgrade to 0.17.0 or later and avoid extracting tar archives from untrusted sources until patched.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Upgrade GluonTS to version 0.17.0 or later.
Avoid extracting tar archives from untrusted sources in environments that run GluonTS until the update is applied.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-119083CVSS 8.4Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. T

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins

Support usRedTeamDaily has no paywall. Readers like you keep security news free for everyone.