Every CVESearch/Get API key

CVE-2026-12701

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

9.0 Critical

CVE-2026-12701 is a critical vulnerability (CVSS 9.0) in Red Hat Ansible Automation Platform 2, published July 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. No source names a fixed version.

What does this mean?
Severity
9.0 CriticalCVSS 3.1, CVE List
Exploit chance
1.19%EPSS, 68th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
High

Exploit likelihood

1.19%Up 0.4 points since Jul 21, 2026
90%50%10%1%

Affected products

Show 1 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 25 CVEs
before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 25 CVEs
before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
Show 108 moreShow less
Affected packages
PackageAffectedFixed
python3.12-pulpcore
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:3.49.63-2.el8ap
0:3.49.63-2.el8ap
python3.12-pulpcore
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:3.49.63-2.el9ap
0:3.49.63-2.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 25 CVEs
before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 25 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 25 CVEs
before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 25 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:3.1.50-1.el8ap
0:3.1.50-1.el8ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:3.1.50-1.el9ap
0:3.1.50-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
python3.12-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
before 0:2.7.0-1.el8ap
0:2.7.0-1.el8ap
ansible-test
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
automation-controller
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-gateway
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-gateway-config
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-hub
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:4.10.16-1.el8ap
0:4.10.16-1.el8ap
python3.12-galaxy-ng
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:4.10.16-1.el8ap
0:4.10.16-1.el8ap
python3.12-pulp-ansible
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 1:0.25.6-1.el8ap
1:0.25.6-1.el8ap
python3.12-pulp-container
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:2.19.12-1.el8ap
0:2.19.12-1.el8ap
python3.12-pyjwt+crypto
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:2.13.0-1.el8ap
0:2.13.0-1.el8ap
python3.12-pyjwt
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:2.13.0-1.el8ap
0:2.13.0-1.el8ap
python3.12-pysequoia
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-pysequoia-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-pysequoia-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-urllib3
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
before 0:2.7.0-1.el8ap
0:2.7.0-1.el8ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
python3.12-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
before 0:2.7.0-1.el9ap
0:2.7.0-1.el9ap
ansible-test
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-gateway
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-gateway-config
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-hub
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:4.10.16-1.el9ap
0:4.10.16-1.el9ap
python3.12-galaxy-ng
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:4.10.16-1.el9ap
0:4.10.16-1.el9ap
python3.12-pulp-ansible
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 1:0.25.6-1.el9ap
1:0.25.6-1.el9ap
python3.12-pulp-container
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:2.19.12-1.el9ap
0:2.19.12-1.el9ap
python3.12-pyjwt+crypto
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:2.13.0-1.el9ap
0:2.13.0-1.el9ap
python3.12-pyjwt
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:2.13.0-1.el9ap
0:2.13.0-1.el9ap
python3.12-pysequoia
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:0.1.34-1.el9ap
0:0.1.34-1.el9ap
python3.12-pysequoia-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:0.1.34-1.el9ap
0:0.1.34-1.el9ap
python3.12-pysequoia-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:0.1.34-1.el9ap
0:0.1.34-1.el9ap
python3.12-urllib3
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
before 0:2.7.0-1.el9ap
0:2.7.0-1.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 0:2.6.11-1.el9ap
0:2.6.11-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 0:4.7.14-3.el9ap
0:4.7.14-3.el9ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 14 CVEs
before 2:2.16.19-1.el10ap
2:2.16.19-1.el10ap
ansible-core
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 14 CVEs
before 2:2.16.19-1.el10ap
2:2.16.19-1.el10ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 14 CVEs
before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 14 CVEs
before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
python3.12-pulpcore
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 0:3.49.63-2.el9ap
0:3.49.63-2.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 14 CVEs
before 0:1.6.6-1.el10ap
0:1.6.6-1.el10ap
receptor
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 14 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 14 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 0:2.6.17-1.el9ap
0:2.6.17-1.el9ap
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 0:2.6.17-1.el9ap
0:2.6.17-1.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 0:2.6.17-1.el9ap
0:2.6.17-1.el9ap
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 0:2.6.17-1.el9ap
0:2.6.17-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
before 0:3.1.50-1.el9ap
0:3.1.50-1.el9ap
python-pulpcore
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 4 CVEs
before 0:3.49.39-2.el8pc
0:3.49.39-2.el8pc
python3.11-pulpcore
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 4 CVEs
before 0:3.49.39-2.el8pc
0:3.49.39-2.el8pc
python-pulpcore
Red Hat:satellite:6.16::el8
From an advisory covering 4 CVEs
before 0:3.49.39-2.el8pc
0:3.49.39-2.el8pc
python3.11-pulpcore
Red Hat:satellite:6.16::el8
From an advisory covering 4 CVEs
before 0:3.49.39-2.el8pc
0:3.49.39-2.el8pc
python-pulpcore
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 4 CVEs
before 0:3.49.39-2.el9pc
0:3.49.39-2.el9pc
python3.11-pulpcore
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 4 CVEs
before 0:3.49.39-2.el9pc
0:3.49.39-2.el9pc
python-pulpcore
Red Hat:satellite:6.16::el9
From an advisory covering 4 CVEs
before 0:3.49.39-2.el9pc
0:3.49.39-2.el9pc
python3.11-pulpcore
Red Hat:satellite:6.16::el9
From an advisory covering 4 CVEs
before 0:3.49.39-2.el9pc
0:3.49.39-2.el9pc
yggdrasil-worker-forwarder
Red Hat:satellite:6.16::el8
From an advisory covering 4 CVEs
before 0:0.0.4-1.el8sat
0:0.0.4-1.el8sat
yggdrasil-worker-forwarder
Red Hat:satellite:6.16::el9
From an advisory covering 4 CVEs
before 0:0.0.4-1.el9sat
0:0.0.4-1.el9sat
python-pulpcore
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
before 0:3.63.21-2.el9pc
0:3.63.21-2.el9pc
python3.11-pulpcore
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
before 0:3.63.21-2.el9pc
0:3.63.21-2.el9pc
python-pulpcore
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
before 0:3.63.21-2.el9pc
0:3.63.21-2.el9pc
python3.11-pulpcore
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
before 0:3.63.21-2.el9pc
0:3.63.21-2.el9pc
yggdrasil-worker-forwarder
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
before 0:0.0.4-1.el9sat
0:0.0.4-1.el9sat
python3.12-pulpcore
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 6 CVEs
before 0:3.73.30-2.el9pc
0:3.73.30-2.el9pc
python3.12-pulpcore
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
before 0:3.73.30-2.el9pc
0:3.73.30-2.el9pc
yggdrasil-worker-forwarder
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
before 0:0.0.4-1.el9sat
0:0.0.4-1.el9sat
python3.12-pulpcore
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 5 CVEs
before 0:3.85.15-5.el9pc
0:3.85.15-5.el9pc
python3.12-pulpcore
Red Hat:satellite:6.19::el9
From an advisory covering 5 CVEs
before 0:3.85.15-5.el9pc
0:3.85.15-5.el9pc
yggdrasil-worker-forwarder
Red Hat:satellite:6.19::el9
From an advisory covering 5 CVEs
before 0:0.0.4-1.el9sat
0:0.0.4-1.el9sat

What each source reports

CVE List Score used9.0

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Record
CVE-2026-12701
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-459549.0

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Record
EUVD-2026-45954
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-j5cg-p988-g42q9.0

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only...

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Record
GHSA-j5cg-p988-g42q
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
NVD9.0

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Record
CVE-2026-12701
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSVRHSA-2026:420789.0

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:42078
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-13
OSVRHSA-2026:420799.0

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:42079
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-13
Show 4 moreShow less
OSVRHSA-2026:420829.0

Red Hat Security Advisory: Satellite 6.16.11 Async Update

Record
RHSA-2026:42082
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-13
OSVRHSA-2026:421509.1

Red Hat Security Advisory: Satellite 6.17.9.1 Async Update

Record
RHSA-2026:42150
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-13
OSVRHSA-2026:421519.1

Red Hat Security Advisory: Satellite 6.18.7.1 Async Update

Record
RHSA-2026:42151
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-13
OSVRHSA-2026:422409.1

Red Hat Security Advisory: Satellite 6.19.2.1 Async Update

Record
RHSA-2026:42240
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-13

History

History
RecordedChangedSources
affected, factsEUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 174 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open