CVE-2026-103754

A moderate severity flaw was found in ansible-runner, affecting the automation-controller component of Red Hat Ansible Automation Platform. The unstream_dir() function, used on the worker side of the ansible-runner transmit/worker protocol, extracts a streamed zip archive while re-creating symbolic links from the archive content without validating their targets, and applies chmod()/utime() to an unsanitized filesystem path derived from the archive member names. A crafted archive processed by a worker that consumes attacker-influenced input can therefore create files, create symbolic links, or change permissions outside the intended target directory, which can be leveraged toward code execution. In the standard Ansible Automation Platform deployment the transmit stream is produced by the trusted controller and the controller-to-executor path is authenticated, so there the issue is primarily a defense-in-depth hardening concern; deployments that feed untrusted input into ansible-runner's worker path are directly exposed. Red Hat and the upstream CVE record both rate this flaw as moderate impact (CVSS 3.1 score 5.9), so there is no difference from the upstream severity assessment. A fix is deferred for the affected Ansible Automation Platform streams because exploitation requires attacker-influenced input to reach the worker's extraction path, which the standard trusted controller-to-executor topology prevents; the residual risk is limited to deployments that pass untrusted input into ansible-runner's worker path until a fix is applied. The ansible_automation_platform-2.4 stream is out of support scope and will not receive an update for this issue.