CVE-2026-71364: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 involves improper limitation of a pathname to a restricted directory during project archive extraction. The project_archive action plugin joins the project directory path with archive member filenames without normalizing paths or validating boundaries, allowing directory traversal sequences. An attacker controlling archive content can write files arbitrarily on the execution node's filesystem outside the intended project directory. This can be exploited to achieve arbitrary file writes as the extraction user, potentially leading to remote code execution via cron files, SSH keys, or playbook content injection. Red Hat has released security updates addressing this issue as part of an important security advisory.

Successful exploitation allows an attacker who controls the archive content to write files to arbitrary locations on the target system with the privileges of the user performing the extraction. This can lead to remote code execution by placing malicious files such as cron jobs or SSH authorized keys, compromising system integrity and confidentiality. The CVSS score of 7.2 (high) reflects the network attack vector, low attack complexity, high impact on confidentiality, integrity, and availability, and the requirement for high privileges but no user interaction.

Red Hat has released official security updates that fix this vulnerability. Users of Red Hat Ansible Automation Platform 2.5 for RHEL 8 should apply the patches provided in the Red Hat security advisory RHSA-2026:59135 and related errata promptly. The vendor advisory confirms the availability of an official fix. No additional mitigation steps are required beyond applying the update.