CVE-2026-119083 - GluonTS arbitrary file write during archive extraction
Bulletin ID: 2026-171-AWS Publication Date: 11/05/2026 08:30 AM PST Description: GluonTS is an open-source Python library for probabilistic time series modeling. We identified CVE-2026-119083, an issue in the archive extraction utility in GluonTS before 0.17.0. An actor who supplies a crafted tar archive containing symbolic or hard links might be able to write arbitrary files outside the intended extraction directory with the privileges of the extracting process. Impacted versions: Refer to the article below for the most up-to-date and complete information. Read this article
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services
- Product
- Python / PyPI packages
- Exposure class
- Developer platform
Why it ranks 40 (Notable)
- Product class: developer platform
- Widely deployed vendor product (Amazon Web Services)
- Covered by 2 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-119083 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.