VULNERABILITY INTELLIGENCE

CVE-2020-10691

CVSS score5.2 MEDIUM

EPSS probability0.30%

CISA KEVNot currently listed

Published2020-04-30

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Description

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

Weakness classification

secalert@redhat.com: CWE-22
nvd@nist.gov: CWE-22

Primary references

secalert@redhat.com — Issue Tracking, Mitigation, Vendor Advisory
secalert@redhat.com — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory