The flaw lies in the AWX project archive extraction routine, where archive members are concatenated with the destination directory without path normalization or boundary checks. This omission falls under CWE-22 and permits a malicious archive to write files to any location on the controller host. An attacker who can influence the archive content—whether by hosting a manipulated zip or tar, tampering with an upstream source, or intercepting a plain‑HTTP transfer—can place files such as cron jobs, SSH authorized_keys, or malicious playbooks. If these injected files reside in writable system directories, they can grant the attacker remote code execution with the privileges of the user performing the extraction.

Red Hat Ansible Automation Platform versions 2.5, 2.6, and 2.7 on RHEL 8 and 9 are affected; 2.6 is also present on RHEL 10. The core platform along with the developer and inside editions for each supported RHEL tier remain vulnerable until a patch is applied.

The CVSS score of 7.2 indicates high severity. The EPSS value of 0.01202 means exploitation is not widespread yet but the probability is not zero. The vulnerability is not listed in the CISA KEV catalog. The most realistic attack scenario involves an attacker controlling or tampering with the archive source that the controller fetches; during extraction the path traversal allows arbitrary file writes which can lead to remote code execution or system compromise if privileged directories are targeted.