This advisory covers multiple security vulnerabilities in Red Hat Ansible Automation Platform 2.5 containers. CVE-2025-6985 is an XXE vulnerability in the langchain-text-splitters component, which can lead to XML external entity attacks. CVE-2025-7647 involves insecure temporary file handling in the run-llama/llama_index component of the lightspeed-chatbot container. CVE-2025-59682 is a potential partial directory traversal vulnerability via the archive.extract() function in the lightspeed container. CVE-2025-59681 describes a potential SQL injection vulnerability in Django QuerySet methods (annotate(), alias(), aggregate(), and extra()) when used with MySQL and MariaDB databases. The advisory also includes updates to the ansible.controller collection and fixes for bugs related to installation and API data gathering. The vendor has released updated container images and collections to address these issues.

The vulnerabilities could allow an attacker to perform XML external entity attacks, exploit insecure temporary file handling, conduct directory traversal attacks, or execute SQL injection attacks within the affected container components of Ansible Automation Platform 2.5. These issues could lead to unauthorized data access or manipulation within the automation platform environment. The advisory rates the severity as high but does not report any known exploits in the wild at this time.

Red Hat has released updated container images and collections for Ansible Automation Platform 2.5 that address these vulnerabilities. Users should apply the updates provided in Red Hat Security Advisory RHSA-2025:18984 to remediate these issues. The advisory does not indicate that no action is required or that the issues are already mitigated without updates. Therefore, applying the official updates is the recommended mitigation step.