Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory
Published Oct 1, 2026
5.9
MEDIUMCVSS 3.1
Description
A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod() and utime() to an unsanitized filesystem path derived from the archive member name. A crafted archive processed by a worker that consumes attacker-influenced input can create files, create symbolic links, or change permissions outside the intended target directory, which can be leveraged toward code execution.
Affected products
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | affected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed Oct 1, 2026 · SSVC 2.0.3
No EPSS score for this CVE.
References (3)
- https://access.redhat.com/security/cve/CVE-2026-103754 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2544510 issue-trackingx_refsource_REDHAT
- https://github.com/ansible/ansible-runner/pull/1550
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-103754 | vdb-entryx_refsource_REDHAT | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2544510 | issue-trackingx_refsource_REDHAT | |
| https://github.com/ansible/ansible-runner/pull/1550 |
Change history (0)
No recorded changes yet.