Homepage

Directory Traversal The advisory has been revoked - it doesn't affect any version of package ansible.src  (opens in a new tab)

Threat Intelligence

EPSS
0.16% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-ANSIBLESRC-15338045
  • published24 Feb 2026
  • disclosed18 Feb 2020
Report a new vulnerability Found a mistake?

Introduced: 18 Feb 2020

CVE-2020-1737  (opens in a new tab)
CWE-22  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ansible.src package and not the ansible.src package as distributed by RHEL.

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

References