CVE-2026-71364

{"id": "CVE-2026-71364", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71364", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T14:28:14.909147Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.5::el8", "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.6.32-1.el8ap", "lessThan": "*", "versionType": "rpm"}], "packageName": "automation-controller", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.5::el8", "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.6.32-1.el9ap", "lessThan": "*", "versionType": "rpm"}], "packageName": "automation-controller", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el10", "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.7.16-1.el9ap", "lessThan": "*", "versionType": "rpm"}], "packageName": "automation-controller", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6", "versions": [{"status": "unaffected", "version": "1787244009", "lessThan": "*", "versionType": "rpm"}], "packageName": "ansible-automation-platform-26/controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.7::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.7", "versions": [{"status": "unaffected", "version": "1787220257", "lessThan": "*", "versionType": "rpm"}], "packageName": "ansible-automation-platform-27/controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-24T16:17:22.663", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59135", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59136", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59153", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59155", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-71364", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511900", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. A malicious archive containing members with path traversal components can write files to arbitrary locations on the execution node's filesystem outside the intended project directory. An attacker who controls the archive content, either through a compromised upstream source, a malicious archive URL, or a man-in-the-middle attack on a plain HTTP connection, can achieve arbitrary file writes as the user performing the extraction, potentially leading to remote code execution through mechanisms such as cron files, SSH authorized keys, or playbook content injection."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta fue encontrada en la extracci\u00f3n de archivos de proyecto de AWX. El plugin de acci\u00f3n project_archive extrae miembros de archivos zip y tar uniendo la ruta del directorio del proyecto con el nombre de archivo del miembro sin realizar normalizaci\u00f3n de ruta, validaci\u00f3n de l\u00edmites o rechazar secuencias de salto de directorio. Un archivo malicioso que contiene miembros con componentes de salto de ruta puede escribir archivos en ubicaciones arbitrarias en el sistema de archivos del nodo de ejecuci\u00f3n fuera del directorio de proyecto previsto. Un atacante que controla el contenido del archivo, ya sea a trav\u00e9s de una fuente ascendente comprometida, una URL de archivo maliciosa o un ataque man-in-the-middle en una conexi\u00f3n HTTP simple, puede lograr escrituras de archivos arbitrarias como el usuario que realiza la extracci\u00f3n, lo que podr\u00eda llevar a la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de mecanismos como archivos cron, claves autorizadas SSH o inyecci\u00f3n de contenido de playbook."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "secalert@redhat.com"}