PT-2026-83282 · Amazon · Amazon-Ssm-Agent
CVE-2026-81849
·
Published
2026-08-28
·
Updated
2026-08-31
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
amazon-ssm-agent versions prior to 3.3.4515.0
Description
Improper limitation of a pathname to a restricted directory in the
aws:downloadContent plugin allows an authenticated remote user with ssm:SendCommand permissions restricted to the AWS-DownloadContent document to write arbitrary files outside the intended download directory with root privileges. This is achieved by using crafted object keys in the S3 source that the document retrieves. Overwriting specific sensitive files may lead to arbitrary code execution as root.Recommendations
Upgrade to version 3.3.4515.0 or later.
Exploit
Fix
RCE
Relative Path Traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Amazon-Ssm-Agent