PT-2026-61593 · Pulpcore · Pulpcore

CVE-2026-12701 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions pulpcore (affected versions not specified)

Description A path traversal issue exists where the relative path validator() function only checks if content paths start with a forward slash but does not block directory traversal sequences like ../. An authenticated administrator can use a relative path containing these sequences to escape the intended export directory during FilesystemExport operations. Since the file content is user-controlled via uploaded artifacts, this allows arbitrary file writes to any location accessible by the Pulp service user, which could lead to service compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-12701

Affected Products

Pulpcore

References · 11

• https://access.redhat.com/errata/RHSA-2026:42079 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:42150 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:42082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-12701 · Security Note
• https://access.redhat.com/errata/RHSA-2026:42240 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:42151 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:42078 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2490703 · Note
• https://access.redhat.com/security/cve/CVE-2026-12701 · Note
• https://twitter.com/OrizonCyber/status/2079272644390666650 · Twitter Post
• https://twitter.com/vulnipulse/status/2079214556547858833 · Twitter Post