{"id":"EM-20261105-OJMO","url":"https://cyber.eventmonitor.net/incident/EM-20261105-OJMO/gluonts-vulnerability-cve-2026-119083/","type":"cve","title":"GluonTS Vulnerability (CVE-2026-119083)","subtitle":"CVE-2026-119083","subject":"CVE-2026-119083","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T17:17:55.840Z","firstSignal":"2026-11-05T16:34:57.000Z","lastSignal":"2026-11-05T17:17:55.840Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T17:17:55.840Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T17:17:55.840Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T16:34:57.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T17:17:55.840Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-OJMO created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T17:17:55.840Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T17:17:55.840Z","detail":"CVSS 8.4"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T16:34:57.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T16:34:57.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-119083 (important)","text":"gluonts: GluonTS: Arbitrary file write via path traversal in archive extraction","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-119083.json"},{"at":"2026-11-05T17:17:55.840Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-119083 (CVSS 8.4)","text":"Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive.\n\n\n\nTo remediate this issue, users should upgrade to version 0.17.0 or later.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119083"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T17:17:55.840","score":8.4,"severity":"HIGH","desc":"Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the…","product":"","seen":1793917591435},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}