CVE-2026-12701
Description
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
Statement
This vulnerability is rated as Important severity because an authenticated administrator can achieve arbitrary file write outside the intended export directory with fully attacker-controlled content. The FilesystemExport API is restricted to admin-level users (in Satellite, authenticated via SSL certificate; in standalone RBAC deployments, admin role only). The Pulp process runs as the "pulp" system user (not root), and file permission bits cannot be controlled by the attacker. However, the "pulp" user typically has write access to service-critical paths, and attack vectors such as cron.d entries (text-parsed, no exec bit required) or overwriting Pulp configuration remain viable depending on filesystem permissions and SELinux policy. Red Hat Satellite and Red Hat Ansible Automation Hub ship pulpcore and are affected. RHUI is not affected because end users do not have access to Pulp content creation APIs.
Mitigation
There is no complete mitigation for this vulnerability. The following measures can reduce risk:
1. If FilesystemExport was never configured on your deployment, you are not affected by this issue.
2. If FilesystemExporters exist in the database, audit them for path traversal sequences ("../"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.
3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.
4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.
5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9 | N/A | 9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Red Hat CVSS v3 Score Explanation
AV:N - Pulp REST API is network-accessible. AC:L - No race conditions or special prerequisites; FilesystemExport is a standard feature (per CVSS 3.1 spec 2.1.2). PR:H - FilesystemExport restricted to admin-level users (SSL cert auth in Satellite, admin role in RBAC). UI:N - Attacker performs the full chain (content upload + export trigger). S:C - Vulnerable component is Pulp path validation; impacted component is the OS filesystem outside Pulp's export boundary (consistent with FIRST example CVE-2010-0467, Joomla directory traversal). C:L - Write primitive enables planting executable content (cron.d, Python modules) that runs with pulp user privileges and can read files, providing indirect but expected confidentiality impact. I:H - Attacker fully controls file path and content; any location writable by pulp user can be overwritten. A:H - Service disruption via config/data corruption (e.g., overwriting pulp settings, cron.d entries causing resource exhaustion).
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Acknowledgements
Red Hat would like to thank Martin Brodeur (Independent security researcher) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
