CVE-2020-10691

Severity: medium (CVSS 5.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-30 · updated 2026-06-17
Weakness: CWE-22

Description

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

Affected products

RedHat Ansible Engine: from 2.9.0 before 2.9.7 — fixed in 2.9.7
Tower: 3.0

How to fix

Upgrade to a fixed version: RedHat Ansible Engine 2.9.7. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691
https://github.com/ansible/ansible/pull/68596
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691
https://github.com/ansible/ansible/pull/68596

Get alerted when CVE-2020-10691 or the next vulnerability affects your stack