{"id":"CVE-2023-5115","aliases":["GHSA-jpvw-p8pr-9g2x","PYSEC-2026-1120"],"title":"Ansible symlink attack vulnerability","summary":"Ansible symlink attack vulnerability","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","vendor":"ansible","product":"ansible","ecosystem":"pip","affected":["ansible < 8.5.0"],"patched":["ansible 8.5.0"],"published":"2023-12-28","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-jpvw-p8pr-9g2x","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5115"},{"url":"https://github.com/ansible/ansible/commit/1e930684bc0a76ec3d094cd326738ad26416541c"},{"url":"https://access.redhat.com/errata/RHSA-2023:5701"},{"url":"https://access.redhat.com/errata/RHSA-2023:5758"},{"url":"https://access.redhat.com/security/cve/CVE-2023-5115"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233810"},{"url":"https://github.com/ansible-community/ansible-build-data/blob/16d36538b96c65d9e0e28d89781361b69857ac0e/8/CHANGELOG-v8.rst#L221"},{"url":"https://github.com/ansible/ansible"},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"}],"tags":["osv","pip"],"epss":0.00859,"epssPercentile":0.56472,"ingestedAt":"2026-07-08T18:25:50.846Z","slug":"CVE-2023-5115","body":"## Overview\n\nAn absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.\n\n## Affected packages\n\n- `ansible < 8.5.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ansible 8.5.0`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}