CVE-2013-4260: Ansible - Arbitrary File Overwrite via Symlink Attack
Summary
CVE-2013-4260: Ansible Arbitrary File Overwrite Vulnerability. Affects ansible versions >= 1.2, < 1.2.3. Fixed in 1.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It provides a simple and agentless architecture, making it easy to deploy and manage systems. However, Ansible versions 1.2.x before 1.2.3 are vulnerable to an arbitrary file overwrite vulnerability.
Vulnerability Detail
The vulnerability exists in the 'lib/ansible/playbook/init.py' file of Ansible. When a playbook fails to run due to an error, Ansible creates a retry file with a predictable name in the '/var/tmp/ansible/' directory. This retry file is susceptible to a symlink attack, allowing local users to overwrite arbitrary files on the system. By creating a symbolic link to a sensitive file, an attacker can manipulate the retry file to overwrite the target file with malicious content.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.3
This is the first release that contains the fix.
pip install --upgrade "ansible==1.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, users can implement a workaround by manually removing the retry file after each playbook run. This can be done by executing the following command:
$ rm /var/tmp/ansible/retry
Conclusion
The vulnerability in Ansible versions 1.2.x before 1.2.3 allows local users to overwrite arbitrary files on the system through a symlink attack on the retry file. To mitigate this vulnerability, it is crucial to upgrade to Ansible 1.2.3 or later. If immediate upgrade is not possible, manually removing the retry file after each playbook run can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
This vulnerability allows local users to overwrite arbitrary files on the system, potentially leading to unauthorized access, data loss, or system compromise.
Users of Ansible versions 1.2.0 to 1.2.2 are affected by this vulnerability. It is recommended for all users of these versions to upgrade to Ansible 1.2.3 or later.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to apply the necessary patches or upgrades to mitigate the risk.
No, this vulnerability can only be exploited by local users on the system where Ansible is installed.
There is no evidence of active attacks exploiting this vulnerability at the time of this advisory. However, it is still important to apply the recommended fixes to ensure the security of your system.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
