CVE-2026-119083: GluonTS arbitrary file write during archive extraction

Published Nov 5, 2026

Updated

Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive.

To remediate this issue, users should upgrade to version 0.17.0 or later.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GluonTS to a version that resolves this vulnerability.
Fixed in 0.17.0

Event History

Nov 5, 2026

CVE Published

via MITRE·04:34 PM

Data Sourced

via MITRE·04:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems using GluonTS versions before 0.17.0 are exposed when they extract tar archives supplied by an actor who can provide a crafted archive. The resulting file writes occur with the privileges of the process performing the extraction.

What does an attacker need to exploit it?

An attacker needs to supply a specially crafted tar archive containing symbolic or hard links. Exploitation also requires a user or process to extract that archive using the affected GluonTS archive extraction utility.

Is user interaction required?

Yes. The supplied severity vector indicates user interaction is required, consistent with a user or process needing to extract the crafted archive.

What should teams do if they cannot upgrade immediately?

The provided data identifies upgrading to GluonTS 0.17.0 or later as the remediation. Until an upgrade is possible, avoid extracting untrusted tar archives with the affected utility and limit the privileges of any process that must perform extraction.

CVE-2026-119083: GluonTS arbitrary file write during archive extraction

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is user interaction required?

What should teams do if they cannot upgrade immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is user interaction required?

What should teams do if they cannot upgrade immediately?