Sign in
Deutsch English Español Polski
High

Path Traversal in Ansible

  • Disclosed: 09.03.2020
  • Updated: 11.10.2026 11:19

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) ansible >= 2.8.0a1, < 2.8.9, >= 2.9.0a1, < 2.9.6, < 2.7.17 2.8.9, 2.9.6, 2.7.17

References

CVSS score 7.8/10
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-22
Platform
Python (PyPI)
Package
ansible
Disclosed
09.03.2020
Updated
11.10.2026 11:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2020-9 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-893h-35v4-mxqx - CC BY 4.0

Vulnerability history: ansible

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (68) in the archive
Total entries
68
First → latest
09.2013 12.2025
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 9
  • High 24
  • Medium 27
  • Low 6
  • Unrated 2

Disclosures per year

earlier: 4

Severity:
  1. Ansible leaks password to logs
    High · 7.5 CVE-2022-3697 >= 2.5.0, < 7.0.0 7.0.0
  2. Improper Input Validation and Command Injection in Ansible
    High · 7.1 CVE-2021-3583 < 2.9.23rc1, >= 2.10.0a1, < 2.10.11rc1, >= 2.11.0a1, < 2.11.2rc1 2.9.23rc1, 2.10.11rc1, 2.11.2rc1
  3. Insertion of Sensitive Information into Log File in ansible
    High · 5.5 CVE-2021-20178 < 2.9.18 2.9.18
  4. Ansible Exposes Sensitive Information
    High · 7.5 CVE-2021-20228 >= 2.10.0a1, < 2.10.6rc1, >= 2.9.0a1, < 2.9.18rc1, < 2.8.19rc1 2.10.6rc1, 2.9.18rc1, 2.8.19rc1
  5. OS Command Injection and Improper Input Validation in ansible
    High · 7.3 CVE-2019-14904 < 2.7.16, >= 2.8.0a1, < 2.8.8, >= 2.9.0a1, < 2.9.3 2.7.16, 2.8.8, 2.9.3
  6. Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible
    High · 5.6 CVE-2019-14905 >= 2.7.0a1, < 2.7.16, >= 2.8.0a1, < 2.8.8, >= 2.9.0a1, < 2.9.3 2.7.16, 2.8.8, 2.9.3
  7. Path Traversal in Ansible this entry
    High · 7.8 CVE-2020-1737 >= 2.8.0a1, < 2.8.9, >= 2.9.0a1, < 2.9.6, < 2.7.17 2.8.9, 2.9.6, 2.7.17
  8. OS Command Injection in ansible
    High · 7.4 CVE-2020-1734 >= 2.10.0a1, < 2.10.0rc1, >= 2.9.0a1, < 2.9.11, < 2.8.13 2.10.0rc1, 2.9.11, 2.8.13
  9. The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.
    Critical · 9.8 CVE-2014-4657 < 1.5.4 1.5.4
  10. The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability ex
    Critical · 9.8 CVE-2014-4678 < 1.6.4 1.6.4
  11. Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as de
    Critical · 9.8 CVE-2014-4967 < 1.6.7 1.6.7
  12. Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code v
    Critical · 9.8 CVE-2014-4966 < 1.6.7 1.6.7
  13. Ansible prior to 1.5.4 mishandles the evaluation of some strings.
    High · 7.5 CVE-2014-2686 < 1.5.4 1.5.4
  14. ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
    High · 6.5 CVE-2019-14856 >= 2.6.0, < 2.6.20, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.6 2.6.20, 2.7.14, 2.8.6
  15. Exposure of Sensitive Information to an Unauthorized Actor in ansible
    High · 6.5 CVE-2019-10217 >= 2.8.0a1, < 2.8.4 2.8.4
  16. ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain
    High · 6.5 CVE-2019-10206 >= 2.6.0, < 2.6.19, >= 2.7.0, < 2.7.13, >= 2.8.0, < 2.8.4 2.6.19, 2.7.13, 2.8.4
  17. In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin
    High · 7.8 CVE-2019-14846 < 2.6.20, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.6 2.6.20, 2.7.14, 2.8.6
  18. ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
    High · 5.3 CVE-2018-16876 >= 2.5.0, < 2.5.14, >= 2.6.0, < 2.6.11, >= 2.7.0, < 2.7.5 2.5.14, 2.6.11, 2.7.5
  19. Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen
    High · 7.8 CVE-2018-16837 >= 2.7, < 2.7.1, >= 2.6, < 2.6.7, < 2.5.11 2.7.1, 2.6.7, 2.5.11
  20. Ansible apt_key module does not properly verify key fingerprint
    High · 7.5 CVE-2016-8614 < 2.2.0.0 2.2.0.0
  21. Ansible fails to properly sanitize fact variables sent from the Ansible controller
    Critical · 9.1 CVE-2016-8628 < 2.2.0.0 2.2.0.0
  22. Ansible fails to properly mark lookup-plugin results as unsafe
    Critical · 9.8 CVE-2017-7481 >= 2.3.0.0, < 2.3.1.0, < 2.1.6.0, >= 2.2.0.0, < 2.2.3.0 2.3.1.0, 2.1.6.0, 2.2.3.0
  23. A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing t
    High · 7.8 CVE-2018-10875 >= 2.5, < 2.5.6, >= 2.4, < 2.4.6.0, >= 2.6, < 2.6.1 2.5.6, 2.4.6.0, 2.6.1
  24. Ansible exposes sensitive data in log files and on the terminal
    High · 5.9 CVE-2018-10855 >= 2.5.0a1, < 2.5.5, >= 2.4.0.0, < 2.4.5.0 2.5.5, 2.4.5.0
  25. In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
    High · 7.8 CVE-2018-10874 < 2.4.6.0, >= 2.5, < 2.5.6, >= 2.6, < 2.6.1 2.4.6.0, 2.5.6, 2.6.1
  26. Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the abili
    High · 8.0 CVE-2017-7466 < 2.3.0.0 2.3.0.0
  27. Ansible fails to cache SSH host keys
    Critical · 7.4 CVE-2013-2233 < 1.2.1 1.2.1
  28. Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems
    Critical · 8.1 CVE-2016-9587 < 2.1.4.0, >= 2.2.0.0, < 2.2.1.0 2.1.4.0, 2.2.1.0
  29. A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive inform
    Critical · 9.8 CVE-2017-7550 >= 2.3.0.0, < 2.3.3.0, >= 2.4.0.0, < 2.4.1.0 2.3.3.0, 2.4.1.0
  30. The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
    High · 8.8 CVE-2014-3498 < 1.6.6 1.6.6
  31. The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
    High · 7.8 CVE-2015-6240 < 1.9.2 1.9.2
  32. Link Following in ansible
    High · 7.8 CVE-2016-3096 >= 2.0.0.0, < 2.0.2.0, < 1.9.6.1 2.0.2.0, 1.9.6.1
  33. Ansible does not verify that the server hostname matches a domain name in certificates
    High · 7.5 CVE-2015-3908 < 1.9.2 1.9.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.