AWS Research and Engineering Studio FileBrowser API Command Injection Vulnerability
Vulnerability
A command injection vulnerability has been identified in the FileBrowser API of AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. This vulnerability allows remote authenticated users to execute arbitrary commands on the cluster-manager EC2 instance by injecting shell meta-characters into unsanitized file path parameters when using the FileBrowser functionality.
Impact
Exploitation of this vulnerability allows for arbitrary command execution on the cluster-manager EC2 instance.
Remediation
Users are advised to upgrade to AWS Research and Engineering Studio version 2026.03 or apply the corresponding mitigation patch to their existing environment. Instructions for applying the patch are available on the AWS GitHub repository.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.