CVE-2026-81849: Path traversal in the aws:downloadContent plugin in amazon-ssm-agent
Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the intended download directory with root privileges, via crafted object keys in the S3 source the document is directed to retrieve. This issue may lead to arbitrary code execution as root if specific sensitive files are overwritten.
To remediate this issue, customers should upgrade amazon-ssm-agent to version 3.3.4515.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
amazon-ssm-agentto a version that resolves this vulnerability.Fixed in 3.3.4515.0
Event History
Frequently Asked Questions
Which systems are exposed to exploitation?
Systems running amazon-ssm-agent before version 3.3.4515.0 are affected when an authenticated user has ssm:SendCommand permission limited to the AWS-DownloadContent document and can cause that document to retrieve crafted object keys from an S3 source.
What access does an attacker need?
The attacker needs authenticated AWS access with ssm:SendCommand permission for the AWS-DownloadContent document. No user interaction is required, and exploitation uses crafted S3 object keys supplied through the document's download source.
What is the potential impact on an affected managed instance?
The flaw can write files outside the intended download directory with root privileges. Overwriting specific sensitive files may allow arbitrary code execution as root.
What should be done if the agent cannot be upgraded immediately?
Restrict ssm:SendCommand access to the AWS-DownloadContent document so untrusted users cannot invoke it, and prevent untrusted S3 object keys from being retrieved through that document. Upgrade to amazon-ssm-agent 3.3.4515.0 or later as the remediation.
How can I determine whether an instance is affected?
Check whether the instance runs amazon-ssm-agent earlier than 3.3.4515.0. Also review whether any principals can send commands using the AWS-DownloadContent document and direct it to S3 sources they can influence.