Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport (Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8)

CVE-2026-12701
CRITICAL 9.0

At a glance

Source
NVD
EPSS
EPSS 1.19 % · percentile 68 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Awaiting Analysis

Search on…

Description

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Weaknesses (CWE)

  • CWE-22 — Improper Limitation of a Pathname to a Restricted Directory

References

Scores

VersionScoreVectorScored by
CVSS 3.1CRITICAL 9.0CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:Hredhat
CVSS 3.1CRITICAL 9.0CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:HNVD · secalert@redhat.com (Secondary)

European references

Affected products

ProductVersions
Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8unaffected 0:3.49.63-2.el8ap < *
Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9unaffected 0:3.49.63-2.el9ap < *
Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9unaffected 0:3.49.63-2.el9ap < *
Red Hat · Red Hat Satellite 6.16 for RHEL 8unaffected 0:3.49.39-2.el8pc < *
Red Hat · Red Hat Satellite 6.16 for RHEL 8unaffected 0:3.49.39-2.el8pc < *
Red Hat · Red Hat Satellite 6.16 for RHEL 9unaffected 0:3.49.39-2.el9pc < *
Red Hat · Red Hat Satellite 6.16 for RHEL 9unaffected 0:3.49.39-2.el9pc < *
Red Hat · Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.63.21-2.el9pc < *
Red Hat · Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.63.21-2.el9pc < *
Red Hat · Red Hat Satellite 6.18 for RHEL 9unaffected 0:3.73.30-2.el9pc < *
Red Hat · Red Hat Satellite 6.18 for RHEL 9unaffected 0:3.73.30-2.el9pc < *
Red Hat · Red Hat Satellite 6.19 for RHEL 9unaffected 0:3.85.15-5.el9pc < *
Red Hat · Red Hat Satellite 6.19 for RHEL 9unaffected 0:3.85.15-5.el9pc < *
Red Hat · Red Hat Ansible Automation Platform 2.6unaffected 1783979593 < *
Red Hat · Red Hat Ansible Automation Platform 2.7unaffected 1783919521 < *
Red Hat · Red Hat Ansible Automation Platform 2
Red Hat · Red Hat Update Infrastructure 4 for Cloud Providers
Red Hat · Red Hat Update Infrastructure 5

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD