CVE-2026-52902EPSS p4.2%
CVE-2026-52902CVE-2026-52902
Description
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
Scoring
| CVSS | 4.7 () |
| Vector | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
| EPSS | 0.16% probability of exploitation · percentile 4.2% · 2026-10-05T12:00:23Z |
| Last modified | 2026-08-24 |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.