The vulnerability is a path traversal flaw that allows a crafted tar archive to instruct GluonTS’s extraction utility to write files to locations outside the intended directory. By including symbolic or hard links that point to arbitrary paths, an attacker can cause the extractor to overwrite files on the host filesystem with the privileges of the extracting process. This can result in the modification or creation of sensitive files, enabling malicious code execution, data tampering, or privilege escalation. The weakness is identified as CWE-22, a canonical path traversal vulnerability.

AWS GluonTS applications deploying versions before 0.17.0 are affected. The flaw resides in the archive extraction component that processes tar files, so any deployment that accepts user‑supplied archives – such as data ingestion pipelines or model deployment tools – is vulnerable on the platform where the extraction occurs.

The CVSS score of 8.4 indicates high severity. An EPSS score was not provided, and the issue is not listed in CISA KEV. The attack vector is inferred to be either local or remote, depending on how the extraction routine is invoked; the most common scenario involves a service or application that accepts archive uploads. If the extraction process runs with elevated privileges, an attacker can overwrite critical system files or deploy malicious executables, amplifying the impact. Although no public exploit is known, the combination of high severity, potential remote lift, and lack of mitigations means the vulnerability remains a significant risk to affected deployments.