CVE-2026-81849

Received Received - Intake

Path Traversal in Amazon SSM Agent

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: AMZN

Description

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the intended download directory with root privileges, via crafted object keys in the S3 source the document is directed to retrieve. This issue may lead to arbitrary code execution as root if specific sensitive files are overwritten. To remediate this issue, customers should upgrade amazon-ssm-agent to version 3.3.4515.0 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-81849

EUVD

EUVD-2026-67855

Affected Vendors & Products

Vendor	Product	Version / Range
amazon	amazon-ssm-agent	3.3.4515.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in the aws:downloadContent plugin of amazon-ssm-agent versions before 3.3.4515.0. An authenticated remote user with restricted ssm:SendCommand permissions can exploit crafted object keys in an S3 source to write arbitrary files outside the intended download directory with root privileges. This may lead to arbitrary code execution if sensitive files are overwritten.

Detection Guidance

Detect this vulnerability by checking the installed version of amazon-ssm-agent. Run: 'amazon-ssm-agent --version' or 'systemctl status amazon-ssm-agent'. If the version is below 3.3.4515.0, the system is vulnerable.

Impact Analysis

An attacker could overwrite critical system files with malicious content, gain root-level access, and execute arbitrary code on the affected system. This could lead to full system compromise, data theft, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade amazon-ssm-agent to version 3.3.4515.0 or later immediately. Follow the official release notes for installation instructions. No workarounds are available.

Hi! I’m here to help you understand CVE-2026-81849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70