CVE-2026-84232 Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

Description

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.

Exploitable remotely over the network, with an ordinary account and if a user takes an action; the impact on data or service is limited.

Attack vector

Network

Attack complexity

Low

Privileges required

Low

Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected products and versions