CVE-2019-3828: Red Hat Ansible

Medium severity, CVSS 4.2. EPSS: 0.5% chance of exploitation in the next 30 days.

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

Affected products

• Red Hat Ansible: from 2.5.0, before 2.5.15 (fixed in 2.5.15); from 2.6.0, before 2.6.14 (fixed in 2.6.14); from 2.7.0, before 2.7.8 (fixed in 2.7.8)

Published 2019-03-27. Last modified 2026-06-17.