PYSEC-2026-3550
awxkit has a path traversal vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2026-52902
- Aliases
- GHSA-g29c-rgq6-gxgj
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Description
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
Affected packages
| Package | Versions |
|---|---|
| PyPI · awxkit | introduced 0, last affected 24.6.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-52902 ADVISORY
- https://access.redhat.com/security/cve/CVE-2026-52902 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2486729 WEB
- https://github.com/ansible/awx PACKAGE
- https://pypi.org/project/awxkit PACKAGE
- https://github.com/advisories/GHSA-g29c-rgq6-gxgj ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |