Awx: project archive extraction allows path traversal file writes
Summary
| CVE | CVE-2026-71364 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-24 16:17:22 UTC |
| Updated | 2026-08-24 20:17:10 UTC |
| Description | A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. A malicious archive containing members with path traversal components can write files to arbitrary locations on the execution node's filesystem outside the intended project directory. An attacker who controls the archive content, either through a compromised upstream source, a malicious archive URL, or a man-in-the-middle attack on a plain HTTP connection, can achieve arbitrary file writes as the user performing the extraction, potentially leading to remote code execution through mechanisms such as cron files, SSH authorized keys, or playbook content injection. |
Risk And Classification
Primary CVSS: v3.1 7.2 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-22 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 8 | unaffected 0:4.6.32-1.el8ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 9 | unaffected 0:4.6.32-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.6 For RHEL 9 | unaffected 0:4.7.16-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/security/cve/CVE-2026-71364 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:59136 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:59135 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-08-06T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-08-24T14:59:51.296Z | Made public. |
Workarounds
CNA: There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure: 1. Avoid using archive-type projects (scm_type='archive') until the fix is applied. Use Git-based projects (scm_type='git') instead where possible, as these do not use the vulnerable extraction code path. 2. Ensure all archive source URLs use HTTPS with valid certificates to prevent man-in-the-middle attacks on archive downloads. 3. Only configure archive-type projects with sources from trusted, verified providers. 4. Restrict the ability to create and modify projects to trusted administrators. 5. In containerized deployments, review execution environment container configurations to minimize host volume mounts and ensure the extraction runs with minimal filesystem permissions.