{"id":"AZL-107132","summary":"CVE-2026-89091 affecting package ansible 2.17.11-1","details":"A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691.","modified":"2026-10-11T14:17:49.854710444Z","published":"2026-10-08T22:17:35Z","upstream":["CVE-2026-89091"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89091"}],"affected":[{"package":{"name":"ansible","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.17.11-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107132.json"}}],"schema_version":"1.9.0"}