CVE-2026-124033

medium

Description

The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command. To remediate this issue, users should upgrade to version 3.16.0 or later.

References

https://github.com/aws/aws-parallelcluster/security/advisories/GHSA-h79v-mp93-644r

https://github.com/aws/aws-parallelcluster/releases/tag/v3.16.0

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120448

https://aws.amazon.com/security/security-bulletins/2026-174-aws/

Details

Source: Mitre, NVD

Published: 2026-11-09

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 6.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:N/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 6.4

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Severity: Medium

CVSS v4

Base Score: 5.9

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00435