CVSS 3.1
4.7 mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NCVE-2026-52902
Medium (4.7). EPSS 0.1% chance of exploitation in the next 30 days.
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g29c-rgq6-gxgj | PyPI | awxkit | <=24.6.1 | no fix published |
| PYSEC-2026-3550 | PyPI | awxkit | <=24.6.1 | no fix published |