Description (CNA)
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 8 | unaffected 0:3.49.63-2.el8ap before * |
| Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 9 | unaffected 0:3.49.63-2.el9ap before * |
| Red Hat / Red Hat Ansible Automation Platform 2.6 for RHEL 9 | unaffected 0:3.49.63-2.el9ap before * |
| Red Hat / Red Hat Satellite 6.16 for RHEL 8 | unaffected 0:3.49.39-2.el8pc before * |
| Red Hat / Red Hat Satellite 6.16 for RHEL 8 | unaffected 0:3.49.39-2.el8pc before * |
| Red Hat / Red Hat Satellite 6.16 for RHEL 9 | unaffected 0:3.49.39-2.el9pc before * |
| Red Hat / Red Hat Satellite 6.16 for RHEL 9 | unaffected 0:3.49.39-2.el9pc before * |
| Red Hat / Red Hat Satellite 6.17 for RHEL 9 | unaffected 0:3.63.21-2.el9pc before * |
| Red Hat / Red Hat Satellite 6.17 for RHEL 9 | unaffected 0:3.63.21-2.el9pc before * |
| Red Hat / Red Hat Satellite 6.18 for RHEL 9 | unaffected 0:3.73.30-2.el9pc before * |
| Red Hat / Red Hat Satellite 6.18 for RHEL 9 | unaffected 0:3.73.30-2.el9pc before * |
| Red Hat / Red Hat Satellite 6.19 for RHEL 9 | unaffected 0:3.85.15-5.el9pc before * |
| Red Hat / Red Hat Satellite 6.19 for RHEL 9 | unaffected 0:3.85.15-5.el9pc before * |
| Red Hat / Red Hat Ansible Automation Platform 2.6 | unaffected 1783979593 before * |
| Red Hat / Red Hat Ansible Automation Platform 2.7 | unaffected 1783919521 before * |
| Red Hat / Red Hat Ansible Automation Platform 2 | unaffected |
| Red Hat / Red Hat Update Infrastructure 4 for Cloud Providers | affected |
| Red Hat / Red Hat Update Infrastructure 5 | affected |
CWE
CWE-22
References
- https://access.redhat.com/errata/RHSA-2026:42078
- https://access.redhat.com/errata/RHSA-2026:42079
- https://access.redhat.com/errata/RHSA-2026:42082
- https://access.redhat.com/errata/RHSA-2026:42132
- https://access.redhat.com/errata/RHSA-2026:42142
- https://access.redhat.com/errata/RHSA-2026:42150
- https://access.redhat.com/errata/RHSA-2026:42151
- https://access.redhat.com/errata/RHSA-2026:42240
- https://access.redhat.com/security/cve/CVE-2026-12701
- https://bugzilla.redhat.com/show_bug.cgi?id=2490703
ADP enrichment
No English description supplied.
No references supplied.