CVE-2023-5189: Hub: insecure galaxy-importer tarfile extraction
Vulnerability summary
CVE-2023-5189 is a medium (CVSS 6.5) Relative Path Traversal vulnerability in redhat ansible_automation_platform. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 62.3% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 14-11-2023PublishedVulnerability first disclosed.
- 20-11-2025Last modifiedVulnerability information updated.
Description
A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:NDiffers
- OSV · PypiEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.98%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.98% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-23Relative Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
- CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat2 products
Ubuntu2 products
- ansibleAll versions (No fix recorded)
- ansible-coreAll versions (No fix recorded)
PyPI1 product
- galaxy-importer≤ 0.4.16
3 vendors · 5 products
References
12 links- bugzilla.redhat.com/show_bug.cgi?id=2234387Issue TrackingX Refsource REDHATWEBExploitVendor Advisory
