Path Traversal Vulnerability in AWX Project Archive Extraction
CVE-2026-71364

7.2HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Vendor
CVE Published:
24 August 2026

What is CVE-2026-71364?

A path traversal vulnerability exists in the project archive extraction feature of AWX. This weakness allows a malicious actor to manipulate archive content, leading to potential arbitrary file writes on the filesystem. The vulnerability arises from the inadequate handling of file paths during the extraction process, which fails to validate boundaries or normalize paths. As a result, attackers can exploit this flaw to write files outside the intended project directory. If an attacker controls the contents of the archive, they could inject harmful files, potentially enabling remote code execution through methods such as cron jobs or SSH keys. Immediate attention is recommended for users of affected AWX versions.

References

https://access.redhat.com/security/cve/CVE-2026-71364
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511900
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.