CVE-2026-71364

Name of the Vulnerable Software and Affected Versions AWX (affected versions not specified)

Description A path traversal issue exists in the project archive extraction process. The project archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. This allows an attacker who controls the archive content—via a compromised upstream source, a malicious archive URL, or a man-in-the-middle attack on plain HTTP connections—to write files to arbitrary locations on the execution node's filesystem outside the intended project directory. Such arbitrary file writes can potentially lead to remote code execution through the injection of playbook content, SSH authorized keys, or cron files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.