CVE catalog

CVE-2026-103754

A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbol

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod() and utime() to an unsanitized filesystem path derived from the archive member name. A crafted archive processed by a worker that consumes attacker-influenced input can create files, create symbolic links, or change permissions outside the intended target directory, which can be leveraged toward code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianansible-runnersid2.4.3-2vulnerable
Debianansible-runnerforky2.4.3-2vulnerable
Debianansible-runnertrixie2.4.1-1vulnerable
Debianansible-runnerbookworm2.3.1-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianansible-runnersourcesid(unfixed)not yet assignedNot reported[1149995]
Debianansible-runnersourceforky(unfixed)not yet assignedNot reported[1149995]
Debianansible-runnersourcetrixie(unfixed)not yet assignedNot reported[1149995]
Debianansible-runnersourcebookworm(unfixed)not yet assignedNot reported[1149995]

[Debian bug #1149995]

Notes

[trixie] ansible-runner: Minor issue [bookworm] ansible-runner: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-ansible-runner]Affected

    Source package: [ansible-runner]

    Details (2)

    • 2.3.1-2 · all · bookworm

      Affected

      nvd · ansible-runner · debian · bookworm; nvd · ansible-runner · debian · 12

    • 2.3.1-2 · all · bookworm

      Affected

      nvd · ansible-runner · debian · bookworm; nvd · ansible-runner · debian · 12

  • [python-ansible-runner-doc]Affected

    Source package: [ansible-runner]

    Details (2)

    • 2.3.1-2 · all · bookworm

      Affected

      nvd · ansible-runner · debian · bookworm; nvd · ansible-runner · debian · 12

    • 2.3.1-2 · all · bookworm

      Affected

      nvd · ansible-runner · debian · bookworm; nvd · ansible-runner · debian · 12

[Debian 13 (Trixie)]

  • [python3-ansible-runner]Affected

    Source package: [ansible-runner]

    Details (2)

    • 2.4.1-1 · all · trixie

      Affected

      nvd · ansible-runner · debian · 13

    • 2.4.1-1 · all · trixie

      Affected

      nvd · ansible-runner · debian · 13

  • [python-ansible-runner-doc]Affected

    Source package: [ansible-runner]

    Details (2)

    • 2.4.1-1 · all · trixie

      Affected

      nvd · ansible-runner · debian · 13

    • 2.4.1-1 · all · trixie

      Affected

      nvd · ansible-runner · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]