Path traversal in amazon-ssm-agent aws:downloadContent allows an authenticated user with ssm:SendCommand limited to AWS-DownloadContent to use crafted S3 object keys to write files outside the download directory as root. Overwriting sensitive files can lead to root RCE. Affected: < 3.3.4515.0. Remediate by upgrading to 3.3.4515.0 or higher.