A path traversal vulnerability was found in awxkit's YAML !include directive. The extractFile() function in awxkit/yaml_file.py constructs file paths using os.path.join() with unsanitized user-controlled input from !include tags, without any path containment check. An attacker who can convince a user to import a malicious YAML file via "awx --conf.format yaml import" can read arbitrary YAML-formatted files from the user's filesystem. The included file contents are populated into AWX resource fields and become accessible via the AWX API/UI.

Upstream: https://github.com/ansible/awx/tree/devel/awxkit
Affected file: awxkit/awxkit/yaml_file.py

Limited surface attack factors:
 - Client-side only (awxkit is a CLI tool)
 - Requires user to download and execute a malicious YAML file
 - Only YAML-formatted files can be read (not plaintext/binary)
 - JSON is the default import format; only --conf.format yaml affected
 - API field validations constrain exfiltration