Riskcovery

CVE-2026-52902

Awxkit: path traversal via yaml !include directive

State
Published
Severity
4.7 Medium
Published
Jun 9, 2026
Updated
Aug 24, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.

Scores

CVSSScoreVectorSource
3.14.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:Nredhat

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat
  • 0:4.6.32-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat
  • 0:4.6.32-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat
  • 0:4.7.16-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.7 for RHEL 10Red Hat
  • 0:4.8.6-1.el10ap and laterNot affected
Red Hat Ansible Automation Platform 2.7 for RHEL 9Red Hat
  • 0:4.8.6-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2Red Hat
    Red Hat Ansible Automation Platform 2Red Hat
      Red Hat Ansible Automation Platform 2Red Hat
        Red Hat Ansible Automation Platform 2Red Hat
          Red Hat Ansible Automation Platform 2Red Hat
            Red Hat Ansible Automation Platform 2Red Hat
              Red Hat Ansible Automation Platform 2Red Hat
                Red Hat Ansible Automation Platform 2Red Hat
                  Red Hat Ansible Automation Platform 2Red Hat
                    Red Hat Ansible Automation Platform 2Red Hat

                      References

                      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.