Executive brief
AWX is Red Hat's open-source automation platform for managing infrastructure and applications. A vulnerability in how AWX extracts project archives (ZIP and TAR files) allows malicious archives to write files to any location on the system. An attacker who can control or intercept an archive used by AWX could achieve remote code execution, compromising the automation platform and potentially the infrastructure it manages.
Technical details
The vulnerability is a path traversal flaw in AWX's project_archive action plugin. The plugin extracts archive members by concatenating the project directory path with member filenames without normalizing paths or validating boundaries, allowing directory traversal sequences (e.g., "../") to escape the intended extraction directory. An attacker controlling archive content—via a compromised upstream source, malicious archive URL, or man-in-the-middle attack on unencrypted HTTP—can inject files outside the project directory. This enables arbitrary file writes as the user running the extraction, potentially leading to remote code execution through injection into cron jobs, SSH authorized_keys, or playbook content.
Affected products
- Red Hat AWX <UNKNOWN>
Timeline
- 2026-08-24: disclosed