CVE-2026-124033

Name of the Vulnerable Software and Affected Versions AWS ParallelCluster CLI versions prior to 3.16.0

Description The export-cluster-logs and export-image-logs commands contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket can use a crafted S3 object key to write files outside the intended export directory on the machine executing the command. These files are created with names and content controlled by a third party and operate with the privileges of the user running the command.

Recommendations Upgrade to version 3.16.0 or later.