EUVD-2026-64918
GHSA-6v7v-pp54-gr28
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network vector applies via HTTP archive fetch; PR:H because exploiting direct configuration requires AWX admin rights; S:U since extraction and impact occur on the same execution node.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. A malicious archive containing members with path traversal components can write files to arbitrary locations on the execution node's filesystem outside the intended project directory. An attacker who controls the archive content, either through a compromised upstream source, a malicious archive URL, or a man-in-the-middle attack on a plain HTTP connection, can achieve arbitrary file writes as the user performing the extraction, potentially leading to remote code execution through mechanisms such as cron files, SSH authorized keys, or playbook content injection.
AnalysisAI
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside the intended project directory. Red Hat Ansible Automation Platform 2 is affected when processing zip or tar archives whose member filenames contain directory traversal sequences. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of three distinct preconditions: (1) the attacker holds AWX admin or project-manager privileges sufficient to configure a project's archive URL to point to an attacker-controlled server; (2) a trusted upstream archive source used by an existing AWX project has been compromised at the server level; or (3) the AWX instance fetches project archives over plain HTTP (not HTTPS), enabling a network man-in-the-middle attacker to intercept and substitute a malicious archive. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H accurately reflects that network delivery is possible but requires high privilege - specifically the ability to configure a project's archive source within AWX. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with AWX admin access (or who has compromised an upstream archive server) crafts a zip archive containing a member named '../../.ssh/authorized_keys' with their own SSH public key as content. When AWX processes a project sync using this archive via the project_archive plugin, the file is written to the execution node user's ~/.ssh/authorized_keys, granting the attacker SSH login access to the execution node without further exploitation steps. … |
| Remediation | Apply the patch released by Red Hat for Ansible Automation Platform 2 as described in the advisory at https://access.redhat.com/security/cve/CVE-2026-71364; an exact fixed version number is not confirmed from the available input data and operators should check that advisory directly rather than relying on inferred version numbers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Red Hat Ansible Automation Platform 2 deployments and restrict project archive upload permissions to a minimal trusted administrator group; require HTTPS for all remote archive fetches and block unencrypted HTTP sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated r
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary she
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2:
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated
Remote code execution in galaxy_ng's legacy role import API (v1) allows an authenticated user controlling a git reposito
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user,
Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding
Container privilege escalation in Red Hat Ansible Automation Platform 2 allows non-root users within affected container
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today