Source: ansible-runner Version: 2.4.3-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://github.com/ansible/ansible-runner/pull/1550
Hi, The following vulnerability was published for ansible-runner. CVE-2026-103754[0]: | A flaw was found in ansible-runner. The unstream_dir() function, | which receives and extracts a streamed zip archive on the worker | side of the ansible-runner transmit/worker protocol, re-creates | symbolic links from archive content without validating the link | target and applies chmod() and utime() to an unsanitized filesystem | path derived from the archive member name. A crafted archive | processed by a worker that consumes attacker-influenced input can | create files, create symbolic links, or change permissions outside | the intended target directory, which can be leveraged toward code | execution. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-103754 https://www.cve.org/CVERecord?id=CVE-2026-103754 [1] https://github.com/ansible/ansible-runner/pull/1550 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
