CVE-2026-124033: Relative path traversal in the log export commands in AWS ParallelCluster CLI
The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command.
To remediate this issue, users should upgrade to version 3.16.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS ParallelCluster CLIto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running AWS ParallelCluster CLI versions before 3.16.0 are exposed when a user runs the export-cluster-logs or export-image-logs command against an S3 log-export bucket that an attacker can write to.
What does an attacker need to exploit it?
The attacker needs authenticated write access to the relevant Amazon S3 bucket and must place an object with a crafted key. Exploitation also requires a user to run one of the affected log export commands.
What is the impact on the machine running the export command?
A crafted S3 object key can cause files to be written outside the intended export directory. The attacker controls the names and contents of those files, which are created with the privileges of the user who runs the command.
What should be done if an immediate upgrade is not possible?
Do not run the affected export commands against log-export S3 buckets writable by untrusted or insufficiently trusted principals. Restrict write access to those buckets until the CLI can be upgraded.
How can I remediate the issue?
Upgrade AWS ParallelCluster CLI to version 3.16.0 or later.