A flaw was found in ansible-runner. (CVE-2026-103754)

The ansible-runner component contains a flaw in the unstream_dir() function, which handles streamed zip archives on the worker side of the transmit/worker protocol. This function recreates symbolic links from archive content without validating the link targets and applies chmod() and utime() operations on unsanitized filesystem paths derived from archive member names. An attacker can craft a malicious archive that, when processed, creates files or symbolic links or changes permissions outside the intended target directory. This behavior can be leveraged to achieve code execution on the affected system.

The vulnerability allows an attacker who can supply a crafted archive to the ansible-runner worker to create or modify files and symbolic links outside the designated directory. This unauthorized filesystem manipulation can lead to code execution, posing a significant risk to system integrity. The CVSS score of 5.9 reflects a medium severity with high impact on integrity and low impact on availability and no impact on confidentiality.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or attacker-controlled archives with ansible-runner workers to mitigate risk.