Arbitrary file write via unvalidated fetch path

Path traversal in Red Hat Ansible 2.7.x, 2.8.x, and 2.9.x allows local users on a managed host to write files on the controller. The fetch action trusts the source path returned by the remote slurp module and uses it to build the local destination without ensuring that the normalized path stays beneath the configured directory. Exploitation requires control of a managed host and a controller user to run a fetch task; chosen content can be placed wherever that controller account can write.