Skip to content
fr Sign in
9.0 Critical

CVE-2026-12701 A path traversal vulnerability was found in pulpcore

Description

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Affected products and versions

Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Update Infrastructure 4 for Cloud Providers Versions not published
Red Hat Update Infrastructure 5 Versions not published
Red Hat Satellite 6.17 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Satellite 6.16 for RHEL 8 Versions not published
Show the 5 other branches
Product Affected versions Fixed in
Red Hat Satellite 6.16 for RHEL 9 Versions not published
Red Hat Satellite 6.18 for RHEL 9 Versions not published
Red Hat Satellite 6.19 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 1783979593 earliest → < 1783979593 1783979593
Red Hat Ansible Automation Platform 2.7 1783919521 earliest → < 1783919521 1783919521

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Ansible Automation Platform 2

The 210 CVEs of Red Hat Ansible Automation Platform 2 →
CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a… 3.3 Low CVE-2026-109131 Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl) 5.4 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High
Track this CVE