9

CVE-2026-12701

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2.5 for RHEL 8
Default Statusaffected
Version 0:3.49.63-2.el8ap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2.5 for RHEL 9
Default Statusaffected
Version 0:3.49.63-2.el9ap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2.6 for RHEL 9
Default Statusaffected
Version 0:3.49.63-2.el9ap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.16 for RHEL 8
Default Statusaffected
Version 0:3.49.39-2.el8pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.16 for RHEL 8
Default Statusaffected
Version 0:3.49.39-2.el8pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.16 for RHEL 9
Default Statusaffected
Version 0:3.49.39-2.el9pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.16 for RHEL 9
Default Statusaffected
Version 0:3.49.39-2.el9pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.17 for RHEL 9
Default Statusaffected
Version 0:3.63.21-2.el9pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.17 for RHEL 9
Default Statusaffected
Version 0:3.63.21-2.el9pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.18 for RHEL 9
Default Statusaffected
Version 0:3.73.30-2.el9pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.18 for RHEL 9
Default Statusaffected
Version 0:3.73.30-2.el9pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.19 for RHEL 9
Default Statusaffected
Version 0:3.85.15-5.el9pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Satellite 6.19 for RHEL 9
Default Statusaffected
Version 0:3.85.15-5.el9pc
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2.6
Default Statusaffected
Version 1783979593
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2.7
Default Statusaffected
Version 1783919521
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Ansible Automation Platform 2
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 4 for Cloud Providers
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.76% 0.512
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 9 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://access.redhat.com/security/cve/CVE-2026-12701
https://bugzilla.redhat.com/show_bug.cgi?id=2490703
https://access.redhat.com/errata/RHSA-2026:42078
https://access.redhat.com/errata/RHSA-2026:42079
https://access.redhat.com/errata/RHSA-2026:42142
https://access.redhat.com/errata/RHSA-2026:42082
https://access.redhat.com/errata/RHSA-2026:42132
https://access.redhat.com/errata/RHSA-2026:42150
https://access.redhat.com/errata/RHSA-2026:42151
https://access.redhat.com/errata/RHSA-2026:42240