The vulnerability in Red Hat Ansible Automation Platform 2 arises from the project_archive action plugin extracting zip and tar archive members without proper path normalization or boundary checks. This allows an attacker controlling the archive content to perform path traversal attacks, writing files to arbitrary locations on the execution node's filesystem outside the intended project directory. Exploitation requires control over the archive source, which could be achieved via compromised upstream sources, malicious archive URLs, or man-in-the-middle attacks on unencrypted HTTP connections. The impact includes arbitrary file writes as the extraction user, which can lead to remote code execution through injection of cron files, SSH authorized keys, or playbook content. Containerized deployments may limit impact due to container isolation, but RPM-based deployments run extraction on the host with AWX service user privileges, increasing risk. Red Hat has classified this vulnerability as having important impact but has not yet provided an official fix.

Successful exploitation allows an attacker to write arbitrary files outside the intended project directory with the privileges of the user performing the extraction. This can lead to remote code execution, integrity compromise, confidentiality breaches, and denial of service by overwriting critical files or injecting malicious code. The vulnerability affects availability, integrity, and confidentiality of the affected system. Containerized deployments may reduce impact scope, but RPM-based deployments are more exposed due to host-level execution. The CVSS v3.1 score is 7.2 (high), reflecting network attack vector, low complexity, high privileges required, and high impact on confidentiality, integrity, and availability.

No complete mitigation exists other than applying the update when it becomes available. Until then, Red Hat recommends: 1) Avoid using archive-type projects (scm_type='archive') and prefer Git-based projects (scm_type='git') where possible. 2) Use HTTPS with valid certificates for all archive source URLs to prevent man-in-the-middle attacks. 3) Only use archive sources from trusted, verified providers. 4) Restrict project creation and modification privileges to trusted administrators. 5) For containerized deployments, minimize host volume mounts and ensure extraction runs with minimal filesystem permissions. Monitor Red Hat advisories for the official patch release.