RewindexCVEsAmazon Web Services
CVE-2026-124033: Relative path traversal in the log export commands in AWS ParallelCluster CLI
Description
The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command. To remediate this issue, users should upgrade to version 3.16.0 or later.
Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H · CWE-23
Tracked companies
Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
AWS: aws-parallelcluster
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- aws.amazon.com/security/security-bulletins/2026-174-aws/ (opens in new tab)
- github.com/aws/aws-parallelcluster/releases/tag/v3.16.0 (opens in new tab)
- github.com/aws/aws-parallelcluster/security/advisories/GHSA-h79v-mp93-644r (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)