p PatchFirst

CVE-2026-89091

CVE-2026-89091 · Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.

A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.

CVSS 8.8 · Alta · EPSS 0,5%

Publicación
Actualización

Pila tecnológica: system

Productos y versiones afectados

Fuentes originales

Comprueba tu servidor →