Read the docs
TI-2026-10860 Aliases CVE-2026-12701GHSA-j5cg-p988-g42q

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

Priority MEDIUM 41CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Partial Red Hat: 10 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01194 68th percentileScored 2026-11-07
Fix Partial Red Hat: 8 advisoriesRed Hat: 10 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—3.49.63-2.el8apPatch availableCNA
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—3.49.63-2.el9apPatch availableCNA
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9—3.49.63-2.el9apPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 8—3.49.39-2.el8pcPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 8—3.49.39-2.el8pcPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 9—3.49.39-2.el9pcPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 9—3.49.39-2.el9pcPatch availableCNA
Red HatRed Hat Satellite 6.17 for RHEL 9—3.63.21-2.el9pcPatch availableCNA
Red HatRed Hat Satellite 6.17 for RHEL 9—3.63.21-2.el9pcPatch availableCNA
Red HatRed Hat Satellite 6.18 for RHEL 9—3.73.30-2.el9pcPatch availableCNA
Red HatRed Hat Satellite 6.18 for RHEL 9—3.73.30-2.el9pcPatch availableCNA
Red HatRed Hat Satellite 6.19 for RHEL 9—3.85.15-5.el9pcPatch availableCNA
Red HatRed Hat Satellite 6.19 for RHEL 9—3.85.15-5.el9pcPatch availableCNA
Red HatRed Hat Ansible Automation Platform 2.6—1783979593Patch availableCNA
Red HatRed Hat Ansible Automation Platform 2.7—1783919521Patch availableCNA
Red HatRed Hat Ansible Automation Platform 2——Not affectedCNA
Red HatRed Hat Update Infrastructure 4 for Cloud Providers——No fix listedCNA
Red HatRed Hat Update Infrastructure 5——No fix listedCNA
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 VendorRed Hat Affected — Fixed in 3.49.63-2.el8ap Patch available CNA
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9 VendorRed Hat Affected — Fixed in 3.49.63-2.el9ap Patch available CNA
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 VendorRed Hat Affected — Fixed in 3.49.63-2.el9ap Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 8 VendorRed Hat Affected — Fixed in 3.49.39-2.el8pc Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 8 VendorRed Hat Affected — Fixed in 3.49.39-2.el8pc Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 9 VendorRed Hat Affected — Fixed in 3.49.39-2.el9pc Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 9 VendorRed Hat Affected — Fixed in 3.49.39-2.el9pc Patch available CNA
  • Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.63.21-2.el9pc Patch available CNA
  • Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.63.21-2.el9pc Patch available CNA
  • Red Hat Satellite 6.18 for RHEL 9 VendorRed Hat Affected — Fixed in 3.73.30-2.el9pc Patch available CNA
  • Red Hat Satellite 6.18 for RHEL 9 VendorRed Hat Affected — Fixed in 3.73.30-2.el9pc Patch available CNA
  • Red Hat Satellite 6.19 for RHEL 9 VendorRed Hat Affected — Fixed in 3.85.15-5.el9pc Patch available CNA
  • Red Hat Satellite 6.19 for RHEL 9 VendorRed Hat Affected — Fixed in 3.85.15-5.el9pc Patch available CNA
  • Red Hat Ansible Automation Platform 2.6 VendorRed Hat Affected — Fixed in 1783979593 Patch available CNA
  • Red Hat Ansible Automation Platform 2.7 VendorRed Hat Affected — Fixed in 1783919521 Patch available CNA
  • Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Update Infrastructure 4 for Cloud Providers VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 30

CPEVersionsRoleVendor
cpe:/a:redhat:ansible_automation_platform:2.5::el82.5—Red Hat
cpe:/a:redhat:ansible_automation_platform:2.5::el92.5—Red Hat
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el82.5—Red Hat
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el92.5—Red Hat
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el82.5—Red Hat
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el92.5—Red Hat
cpe:/a:redhat:ansible_automation_platform:2.6::el102.6—Red Hat
cpe:/a:redhat:ansible_automation_platform:2.6::el92.6—Red Hat
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el102.6—Red Hat
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el92.6—Red Hat
  • cpe:/a:redhat:ansible_automation_platform:2.5::el8 Versions 2.5 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform:2.5::el9 Versions 2.5 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 Versions 2.5 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 Versions 2.5 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 Versions 2.5 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 Versions 2.5 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform:2.6::el10 Versions 2.6 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform:2.6::el9 Versions 2.6 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10 Versions 2.6 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9 Versions 2.6 — ·Red Hat
Show 20 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:ansible_automation_platform_inside:2.6::el92.6—Red Hat
cpe:/a:redhat:satellite:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite_capsule:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite_capsule:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite_utils:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite_utils:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite_capsule:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite_utils:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite_capsule:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite_utils:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite:6.19::el96.19—Red Hat
cpe:/a:redhat:satellite_capsule:6.19::el96.19—Red Hat
cpe:/a:redhat:satellite_utils:6.19::el96.19—Red Hat
cpe:/a:redhat:ansible_automation_platform:2.7::el92.7—Red Hat
cpe:/a:redhat:ansible_automation_platform:22—Red Hat
cpe:/a:redhat:rhui:4::el84—Red Hat
cpe:/a:redhat:rhui:5::el95—Red Hat
  • cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9 Versions 2.6 — ·Red Hat
  • cpe:/a:redhat:satellite:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite:6.19::el9 Versions 6.19 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.19::el9 Versions 6.19 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.19::el9 Versions 6.19 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform:2.7::el9 Versions 2.7 — ·Red Hat
  • cpe:/a:redhat:ansible_automation_platform:2 Versions 2 — ·Red Hat
  • cpe:/a:redhat:rhui:4::el8 Versions 4 — ·Red Hat
  • cpe:/a:redhat:rhui:5::el9 Versions 5 — ·Red Hat

Remediation

Red Hat 8 advisories

  • RHSA-2026:42240 Released 2026-07-20 · Red Hat rating Important
    Satellite 6.19.2.1 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 python3.12-pulpcore-3.85.15-5.el9pc, yggdrasil-worker-forwarder-0.0.4-1.el9sat
  • RHSA-2026:42151 Released 2026-07-20 · Red Hat rating Important
    Satellite 6.18.7.1 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 python3.12-pulpcore-3.73.30-2.el9pc, yggdrasil-worker-forwarder-0.0.4-1.el9sat
  • RHSA-2026:42150 Released 2026-07-20 · Red Hat rating Important
    Satellite 6.17.9.1 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 python-pulpcore-3.63.21-2.el9pc, python3.11-pulpcore-3.63.21-2.el9pc, yggdrasil-worker-forwarder-0.0.4-1.el9sat
Show 5 more Red Hat advisories
  • RHSA-2026:42142 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/gateway-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9, registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9 +3
  • RHSA-2026:42132 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:42079 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 ansible-core-2:2.16.19-1.el10ap, receptor-1.6.6-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, automation-controller-venv-tower-4.7.14-3.el9ap, automation-gateway-proxy-2.6.17-1.el9ap +5
  • RHSA-2026:42078 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
  • RHSA-2026:42082 Released 2026-07-20 · Red Hat rating Important
    Satellite 6.16.11 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 python-pulpcore-3.49.39-2.el8pc, python3.11-pulpcore-3.49.39-2.el8pc, yggdrasil-worker-forwarder-0.0.4-1.el8sat
    • Red Hat Satellite 6.16 for RHEL 9 python-pulpcore-3.49.39-2.el9pc, python3.11-pulpcore-3.49.39-2.el9pc, yggdrasil-worker-forwarder-0.0.4-1.el9sat

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 and 3 more products — RHSA-2026:42142

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-10631 Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofingPriority MEDIUM 42
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Update Infrastructure 4 for Cloud ProvidersAffectedNo fix planned: Will not fix
Red Hat Update Infrastructure 5AffectedNo fix yet
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:42132
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:42079
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:42142
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:42082
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:42082
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:42150
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:42151
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:42240
Not affected: 12 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12701
  2. 2026-10-03 Alias added: GHSA-j5cg-p988-g42q

References

Advisory 8

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences