CVE-2024-9902 is a vulnerability in the ansible-core user module that allows an unprivileged user to create or replace any file on the system path and take ownership when a privileged user runs the user module against the unprivileged user's home directory. This occurs if the unprivileged user has traversal permissions on the directory containing the target file, enabling them to control the file contents as its owner.