awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

awxkit has a path traversal vulnerability

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

cipromote (>=1.5.0, <=1.5.2) potentially affected by CVE-2026-52902 via awxkit (23.9.0)

awxkit PYPI version 23.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on awxkit and may be impacted: - cipromote =1.5.0, =1.5.2 Source cves: CVE-2026-52902 Source advisory: OSV:PYSEC-2026-3550...

awx-mcp-server (>=1.1.3, <=1.2.0), broker (>=0.0.0, <=0.6.12) +1 more potentially affected by CVE-2026-52902 via awxkit (24.6.1)

awxkit PYPI version 24.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on awxkit and may be impacted: - awx-mcp-server =1.1.3, =0.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-52902 Source advisory: OSV:PYSEC-2026-3550...

PYSEC-2026-3550 awxkit has a path traversal vulnerability

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

awxkit has a path traversal vulnerability

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

GHSA-G29C-RGQ6-GXGJ awxkit has a path traversal vulnerability

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

awx-mcp-server (>=1.1.3, <=1.2.0), broker (>=0.0.0, <=0.6.12) +1 more potentially affected by CVE-2026-52902 via awxkit (24.6.1)

awxkit PYPI version 24.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on awxkit and may be impacted: - awx-mcp-server =1.1.3, =0.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-52902 Source advisory: GHSA-G29C-RGQ6-GXGJ...

awx-mcp-server (>=1.1.3, <=1.2.0), broker (>=0.0.0, <=0.6.12) +1 more potentially affected by CVE-2026-52902 via awxkit (24.6.1)

awxkit PYPI version 24.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on awxkit and may be impacted: - awx-mcp-server =1.1.3, =0.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-52902 Source advisory: OSV:GHSA-G29C-RGQ6-GXGJ...

cipromote (>=1.5.0, <=1.5.2) potentially affected by CVE-2026-52902 via awxkit (23.9.0)

awxkit PYPI version 23.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on awxkit and may be impacted: - cipromote =1.5.0, =1.5.2 Source cves: CVE-2026-52902 Source advisory: OSV:GHSA-G29C-RGQ6-GXGJ...

Directory Traversal

Overview awxkit is a The official command line interface for Ansible AWX Affected versions of this package are vulnerable to Directory Traversal via the !include directive in YAML files. An attacker can access arbitrary YAML-formatted files from the local filesystem by tricking a user into...

CVE-2026-52902

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

CVE-2026-52902 Awxkit: path traversal via yaml !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

EUVD-2026-35389

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

CVE-2026-52902 Awxkit: path traversal via yaml !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

CVE-2026-52902

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

CVE-2026-52902

CVE-2026-52902 affects awxkit (AWX CLI). The YAML !include directive permits path traversal, enabling an attacker to craft a YAML file that reads arbitrary local YAML files when a user imports it via awx --conf.format yaml import. This is a client-side vulnerability requiring user interaction. Mi...

CVE-2026-52902

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...