Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
Exploitability
AV:LAC:LPR:HUI:RScope
S:CImpact
C:LI:LA:N4.2/CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NInput Validation