CVE-2026-71364: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The vulnerability arises because the project_archive action plugin in AWX joins archive member filenames to the project directory path without validating or normalizing the paths, permitting directory traversal sequences. An attacker controlling the archive content can write files anywhere on the execution node filesystem with the privileges of the extraction user. This can lead to remote code execution via mechanisms such as cron jobs, SSH authorized keys, or playbook injection. The issue is known as a Zip Slip vulnerability. In containerized deployments, the impact may be limited by container isolation, whereas in RPM-based deployments the extraction runs on the host with AWX service user privileges, increasing risk. Red Hat Ansible Automation Platform 2.5 ships the affected code as part of Automation Controller. Red Hat has assessed the impact as Important and has released a security update to fix the vulnerability.

Successful exploitation allows an attacker who can supply or manipulate archive content to write arbitrary files on the execution node with the privileges of the AWX service user. This can lead to remote code execution, confidentiality breaches, integrity violations, and denial of service by overwriting critical files. The vulnerability affects both containerized and RPM-based deployments, with potentially greater impact on RPM-based due to host-level extraction privileges. The CVSS v3.1 base score is 7.2 (High), reflecting network attack vector, low complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update that fixes this vulnerability; applying this update is the recommended remediation. Until the fix is applied, customers should avoid using archive-type projects (scm_type='archive') and prefer Git-based projects instead. Additionally, ensure all archive source URLs use HTTPS with valid certificates to prevent man-in-the-middle attacks, and only use archive sources from trusted providers. Restrict project creation and modification permissions to trusted administrators. In containerized deployments, minimize host volume mounts and run extraction with minimal filesystem permissions to reduce exposure.