CVE-2026-103754: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Ansible Automation Platform 2
A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod() and utime() to an unsanitized filesystem path derived from the archive member name. A crafted archive processed by a worker that consumes attacker-influenced input can create files, create symbolic links, or change permissions outside the intended target directory, which can be leveraged toward code execution.
AI Analysis
Technical Summary
The vulnerability in ansible-runner's unstream_dir() function involves improper validation of symbolic link targets and unsanitized filesystem paths derived from archive member names during extraction of streamed zip archives. An attacker supplying a crafted archive to a worker can cause files or symbolic links to be created or modified outside the designated directory, enabling unauthorized changes that may be leveraged for code execution. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.
Potential Impact
An attacker who can supply a crafted archive to the ansible-runner worker can cause unauthorized file creation, symbolic link creation, or permission changes outside the intended directory. This can be leveraged to execute arbitrary code on the affected system, impacting integrity and potentially availability. There is no confidentiality impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-103754 for current remediation guidance. Until a fix is applied, avoid processing untrusted archives with ansible-runner workers.
CVE-2026-103754: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Ansible Automation Platform 2
Description
A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod() and utime() to an unsanitized filesystem path derived from the archive member name. A crafted archive processed by a worker that consumes attacker-influenced input can create files, create symbolic links, or change permissions outside the intended target directory, which can be leveraged toward code execution.
CVSS v3.1
Score 5.9medium
Affected software
Red Hat
Red Hat Ansible Automation Platform 2
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in ansible-runner's unstream_dir() function involves improper validation of symbolic link targets and unsanitized filesystem paths derived from archive member names during extraction of streamed zip archives. An attacker supplying a crafted archive to a worker can cause files or symbolic links to be created or modified outside the designated directory, enabling unauthorized changes that may be leveraged for code execution. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.
Potential Impact
An attacker who can supply a crafted archive to the ansible-runner worker can cause unauthorized file creation, symbolic link creation, or permission changes outside the intended directory. This can be leveraged to execute arbitrary code on the affected system, impacting integrity and potentially availability. There is no confidentiality impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-103754 for current remediation guidance. Until a fix is applied, avoid processing untrusted archives with ansible-runner workers.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-10-01T10:32:25.691Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-103754","vendor":"Red Hat"}]
Threat ID: 6abe748ca43b0b3b89bd1c88
Added to database: 10/01/2026, 14:56:12 UTC
Last enriched: 10/01/2026, 15:19:04 UTC
Last updated: 10/01/2026, 19:41:31 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.