Local privilege escalation via Postfix-created directory

Job-isolation escape in Red Hat Ansible Tower before 3.8.5 allows local users to gain AWX-user privileges through a malicious playbook. Postfix accepts mail addressed to the awx account and creates an awx-owned folder outside the isolation jail, where attacker-controlled content can include an executable. Low-privileged playbook-author access is required, and executing the planted binary crosses the isolation boundary with the awx account's rights.