Description
Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the intended download directory with root privileges, via crafted object keys in the S3 source the document is directed to retrieve. This issue may lead to arbitrary code execution as root if specific sensitive files are overwritten.



To remediate this issue, customers should upgrade amazon-ssm-agent to version 3.3.4515.0 or later.
Published: 2026-08-28
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the intended download directory with root privileges, via crafted object keys in the S3 source the document is directed to retrieve. This issue may lead to arbitrary code execution as root if specific sensitive files are overwritten. To remediate this issue, customers should upgrade amazon-ssm-agent to version 3.3.4515.0 or later.
Title Path traversal in the aws:downloadContent plugin in amazon-ssm-agent
First Time appeared Amazon
Amazon amazon-ssm-agent
Weaknesses CWE-23
CPEs cpe:2.3:a:amazon:amazon-ssm-agent:*:*:*:*:*:*:*:*
Vendors & Products Amazon
Amazon amazon-ssm-agent
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Amazon Amazon-ssm-agent
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-08-28T18:02:33.468Z

Reserved: 2026-08-27T16:22:32.726Z

Link: CVE-2026-81849

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T20:20:13.940

Modified: 2026-08-28T20:20:13.940

Link: CVE-2026-81849

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-23

    Relative Path Traversal