cve.bz

CVE-2016-3096

7.8 highEPSS 0.5%

The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.

Severity

CVSS 3.0

7.8 high
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE
CWE-59
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-rh6x-qvg7-rrmjPyPIansible>=2.0.0.0 <2.0.2.02.0.2.0
GHSA-rh6x-qvg7-rrmjPyPIansible<1.9.6.11.9.6.1
PYSEC-2016-1PyPIansible<2.0.2.02.0.2.0

References

Check your stackJSON