GluonTS arbitrary file write during archive extraction

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive.

To remediate this issue, users should upgrade to version 0.17.0 or later.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• aws.amazon.com/security/security-bulletins/2026-171-aws Üretici bülteni
• github.com/awslabs/gluonts/releases/tag/v0.17.0 Yama
• github.com/…luonts/security/advisories/GHSA-rg2m-55pr-vp3q Üçüncü taraf

Kayıt geçmişi

1. 5 Kas 2026 19:34Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-102943Dagu MCP DAG specification read bypasses path containment and workspace isolation
• 6,3 CVE-2026-68509FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory
• 7,1 CVE-2026-87008Code Graph RAG: Symlink ile kök dizin dışına çıkılarak dosya okuma ve üzerine yazma
• 7,5 CVE-2026-77604Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read
• 7,2 CVE-2026-63213SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM
• 8,3 CVE-2026-107129Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0