CVE-2026-52902 Awxkit: path traversal via yaml !include directive

Description

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.

Exploitable with local access to the machine, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Local

Attack complexity

High

Privileges required

None

Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected products and versions