CVE-2026-12701

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

State: Published
Severity: 9.0 Critical
Published: Jul 20, 2026
Updated: Oct 8, 2026
Reserved: Jun 19, 2026

Description

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H	redhat

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:3.49.63-2.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:3.49.63-2.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat	0:3.49.63-2.el9ap and laterNot affected
Red Hat Satellite 6.16 for RHEL 8Red Hat	0:3.49.39-2.el8pc and laterNot affected
Red Hat Satellite 6.16 for RHEL 8Red Hat	0:3.49.39-2.el8pc and laterNot affected
Red Hat Satellite 6.16 for RHEL 9Red Hat	0:3.49.39-2.el9pc and laterNot affected
Red Hat Satellite 6.16 for RHEL 9Red Hat	0:3.49.39-2.el9pc and laterNot affected
Red Hat Satellite 6.17 for RHEL 9Red Hat	0:3.63.21-2.el9pc and laterNot affected
Red Hat Satellite 6.17 for RHEL 9Red Hat	0:3.63.21-2.el9pc and laterNot affected
Red Hat Satellite 6.18 for RHEL 9Red Hat	0:3.73.30-2.el9pc and laterNot affected
Red Hat Satellite 6.18 for RHEL 9Red Hat	0:3.73.30-2.el9pc and laterNot affected
Red Hat Satellite 6.19 for RHEL 9Red Hat	0:3.85.15-5.el9pc and laterNot affected
Red Hat Satellite 6.19 for RHEL 9Red Hat	0:3.85.15-5.el9pc and laterNot affected
Red Hat Ansible Automation Platform 2.6Red Hat	1783979593 and laterNot affected
Red Hat Ansible Automation Platform 2.7Red Hat	1783919521 and laterNot affected
Red Hat Ansible Automation Platform 2Red Hat
Red Hat Update Infrastructure 4 for Cloud ProvidersRed Hat
Red Hat Update Infrastructure 5Red Hat

References

RHSA-2026:42078vendor-advisory
RHSA-2026:42079vendor-advisory
RHSA-2026:42082vendor-advisory
RHSA-2026:42132vendor-advisory
RHSA-2026:42142vendor-advisory
RHSA-2026:42150vendor-advisory
RHSA-2026:42151vendor-advisory
RHSA-2026:42240vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-12701vdb-entry
RHBZ#2490703issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.