Bulletin ID: 2026-171-AWS
Publication Date: 11/05/2026 08:30 AM PST
Description:
GluonTS is an open-source Python library for probabilistic time series modeling. We identified CVE-2026-119083, an issue in the archive extraction utility in GluonTS before 0.17.0. An actor who supplies a crafted tar archive containing symbolic or hard links might be able to write arbitrary files outside the intended extraction directory with the privileges of the extracting process.
Impacted versions: < 0.17.0
Refer to the article below for the most up-to-date and complete information.
This article has been indexed from Latest Bulletins
Read the original article:
CVE-2026-119083 – GluonTS arbitrary file write during archive extraction