Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Fixed packages 8

Vulnerabilities 4

• High 8.7
  CVE-2025-59343

  tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

  tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4…

  Mafintosh tar-fs sqlpad code-server Debian Ubuntu Wolfi npm
  Sep 24, 2025
• Medium 6.7
  CVE-2025-9907

  Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

  A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Feb 27, 2026
• Medium 6.7
  CVE-2025-9908

  Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

  A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitive internal infrastructure headers (such as X-Trusted-Proxy and X-Envoy-*) and even…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.6
  Feb 27, 2026
• Low 3.1
  CVE-2025-59682

  Django vulnerable to partial directory traversal via archives

  An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an arch…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Oct 1, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2392834
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2392835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2397901
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2400450
• article
  https://issues.redhat.com/browse/AAP-49448
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19201.json
• report
  https://access.redhat.com/security/cve/CVE-2025-9907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-9907
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-9907
• report
  https://access.redhat.com/security/cve/CVE-2025-9908
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-9908
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-9908
• report
  https://access.redhat.com/security/cve/CVE-2025-59343
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59343
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59343
• article
  https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
• article
  https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v
• report
  https://access.redhat.com/security/cve/CVE-2025-59682
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59682
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59682