CVE-2026-52902
CVE-2026-52902 · Awxkit: path traversal via yaml !include directive
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
CVSS 4.7 · Medium · EPSS 0.1%
- Published
- Updated
Stack: python
Affected products and versions
red hat ansible automation platform 2.5 for rhel 8
- Versions
- ≥ 0:4.6.32-1.el8ap: Not affected (rpm)
No fix published
red hat ansible automation platform 2.5 for rhel 9
- Versions
- ≥ 0:4.6.32-1.el9ap: Not affected (rpm)
No fix published
red hat ansible automation platform 2.6 for rhel 9
- Versions
- ≥ 0:4.7.16-1.el9ap: Not affected (rpm)
No fix published
red hat ansible automation platform 2.7 for rhel 10
- Versions
- ≥ 0:4.8.6-1.el10ap: Not affected (rpm)
No fix published
red hat ansible automation platform 2.7 for rhel 9
- Versions
- ≥ 0:4.8.6-1.el9ap: Not affected (rpm)
No fix published
red hat ansible automation platform 2
No fix published
red hat ansible automation platform 2
No fix published
awxkit PyPI
- Versions
- 13.0.0
- 14.0.0
- 14.1.0
- 15.0.0
- 15.0.1
- 16.0.0
- 17.0.0
- 17.0.1
- 17.1.0
- 18.0.0
- 19.0.0
- 19.1.0
- 19.2.0
- 19.2.1
- 19.2.2
- 19.3.0
- 19.4.0
- 20.0.1
- 20.1.0
- 21.0.0
- 21.1.0
- 21.10.0
- 21.10.1
- 21.10.2
- 21.11.0
- 21.12.0
- 21.13.0
- 21.14.0
- 21.2.0
- 21.3.0
- 21.4.0
- 21.5.0
- 21.6.0
- 21.7.0
- 21.8.0
- 21.9.0
- 22.0.0
- 22.1.0
- 22.2.0
- 22.3.0
- 22.4.0
- 22.5.0
- 22.6.0
- 22.7.0
- 23.0.0
- 23.1.0
- 23.2.0
- 23.3.0
- 23.3.1
- 23.4.0
- 23.5.0
- 23.5.1
- 23.6.0
- 23.7.0
- 23.8.0
- 23.8.1
- 23.9.0
- 24.0.0
- 24.1.0
- 24.2.0
- 24.3.0
- 24.3.1
- 24.4.0
- 24.5.0
- 24.6.0
- 24.6.1
- Affected ranges
- ECOSYSTEM: ≤ 24.6.1
No fix published