{"id":"CVE-2026-124033","published":"2026-11-09T22:18:38.920","lastModified":"2026-11-09T22:18:38.920","description":"The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command.\n\n\n\nTo remediate this issue, users should upgrade to version 3.16.0 or later.","cvssScore":6.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","cwes":["CWE-23"],"vendors":[],"products":[],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-174-aws/","tags":[]},{"url":"https://github.com/aws/aws-parallelcluster/releases/tag/v3.16.0","tags":[]},{"url":"https://github.com/aws/aws-parallelcluster/security/advisories/GHSA-h79v-mp93-644r","tags":[]}],"exploitRefs":[{"url":"https://github.com/aws/aws-parallelcluster/releases/tag/v3.16.0","tags":[]},{"url":"https://github.com/aws/aws-parallelcluster/security/advisories/GHSA-h79v-mp93-644r","tags":[]}],"hasPoc":true,"ai":null}