CVE-2023-5189 Hub: insecure galaxy-importer tarfile extraction

What is CVE-2023-5189?

CVE-2023-5189 is a medium-severity path traversal vulnerability in Redhat Satellite, published on 14 Nov 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

Weakness: CWE-22, CWE-23

Which versions are affected by CVE-2023-5189?

3 open source packages ship an affected version, including galaxy-importer. It affects 2 products.

Products include Redhat Ansible Automation Platform, Redhat Satellite.

How do I fix CVE-2023-5189?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-5189 being exploited?

There is no known exploitation of CVE-2023-5189 in the wild and no public exploit code.

Other vulnerabilities in Redhat Satellite

• CVE-2021-4112 Privilege escalation in ansible-tower High 8.8
• CVE-2023-4237 Platform: ec2_key module prints out the private key directly to the standard output High 7.3
• CVE-2021-3583 Improper Input Validation and Command Injection in Ansible High 7.1
• CVE-2025-9907 Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda Medium 6.7
• CVE-2025-9908 Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams Medium 6.7

All Redhat Satellite vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-55g2-vm3q-7w52, PYSEC-2026-1401, UBUNTU-CVE-2023-5189.