CVE-2026-119083
Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who…
- Risk score
- 47/100
- CVSS
- 7.8 v3.1
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. To remediate this issue…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.17.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.8 high
References
Original description
Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. To remediate this issue, users should upgrade to version 0.17.0 or later.
Last activity 5 Nov 2026. Patch Forecast updates every hour.