GluonTS archive extraction path traversal allows arbitrary file writes

A Python forecasting library can overwrite system files when unpacking archives.

Summary

A path traversal flaw in GluonTS's archive extraction utility lets a crafted tar archive write arbitrary files outside the extraction directory, with the privileges of the extracting process. Versions before 0.17.0 are affected.

Affected when

Extracting tar archives from untrusted sources with GluonTS

What to do

Update to GluonTS 0.17.0 or later. If you cannot upgrade, do not use GluonTS to extract tar archives from untrusted sources.

Products and platforms

gluonts

CVE IDs

CVE-2026-119083 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · aws.amazon.com (opens in a new tab)
Write-up: github.com (opens in a new tab)

Times

First published 2026-11-05 16:34 UTC

First seen 2026-11-09 17:00 UTC