{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12701", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-19T09:53:04.810Z", "datePublished": "2026-07-20T14:18:18.318Z", "dateUpdated": "2026-07-21T04:15:59.204Z"}, "containers": {"cna": {"title": "Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with \"/\" but fails to block directory traversal sequences such as \"../\" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., \"looking/normal/../../../../etc/shadow\") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python3.12-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.49.63-2.el8ap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.5::el8", "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python3.12-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.49.63-2.el9ap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.5::el8", "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python3.12-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.49.63-2.el9ap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el10", "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.49.39-2.el8pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.49.39-2.el8pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.49.39-2.el9pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.49.39-2.el9pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.17 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.63.21-2.el9pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.17::el9", "cpe:/a:redhat:satellite_capsule:6.17::el9", "cpe:/a:redhat:satellite_utils:6.17::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.17 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.63.21-2.el9pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.17::el9", "cpe:/a:redhat:satellite_capsule:6.17::el9", "cpe:/a:redhat:satellite_utils:6.17::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.18 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python3.12-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.73.30-2.el9pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.18::el9", "cpe:/a:redhat:satellite_capsule:6.18::el9", "cpe:/a:redhat:satellite_utils:6.18::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.18 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python3.12-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.73.30-2.el9pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.18::el9", "cpe:/a:redhat:satellite_capsule:6.18::el9", "cpe:/a:redhat:satellite_utils:6.18::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.19 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python3.12-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.85.15-5.el9pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.19::el9", "cpe:/a:redhat:satellite_capsule:6.19::el9", "cpe:/a:redhat:satellite_utils:6.19::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.19 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python3.12-pulpcore", "defaultStatus": "affected", "versions": [{"version": "0:3.85.15-5.el9pc", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.19::el9", "cpe:/a:redhat:satellite_capsule:6.19::el9", "cpe:/a:redhat:satellite_utils:6.19::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "ansible-automation-platform-26/hub-rhel9", "defaultStatus": "affected", "versions": [{"version": "1783979593", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.7", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "ansible-automation-platform-27/hub-rhel9", "defaultStatus": "affected", "versions": [{"version": "1783919521", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.7::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python-pulpcore", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}, {"vendor": "Red Hat", "product": "Red Hat Update Infrastructure 4 for Cloud Providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python-pulpcore", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:rhui:4::el8"]}, {"vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "python-pulpcore-client", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:rhui:5::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:42078", "name": "RHSA-2026:42078", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:42079", "name": "RHSA-2026:42079", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:42082", "name": "RHSA-2026:42082", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:42132", "name": "RHSA-2026:42132", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:42142", "name": "RHSA-2026:42142", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:42150", "name": "RHSA-2026:42150", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:42151", "name": "RHSA-2026:42151", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:42240", "name": "RHSA-2026:42240", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12701", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490703", "name": "RHBZ#2490703", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-07-20T13:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "workarounds": [{"lang": "en", "value": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If FilesystemExport was never configured on your deployment, you are not affected by this issue.\n2. If FilesystemExporters exist in the database, audit them for path traversal sequences (\"../\"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.\n3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.\n4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.\n5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation."}], "timeline": [{"lang": "en", "time": "2026-04-24T02:44:10.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-20T13:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Martin Brodeur (Independent security researcher) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-21T04:15:59.204Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{}

{"acknowledgement": "Red Hat would like to thank Martin Brodeur (Independent security researcher) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2026:42078", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.5::el8", "package": "python3.12-pulpcore-0:3.49.63-2.el8ap", "product_name": "Red Hat Ansible Automation Platform 2.5 for RHEL 8", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42078", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "package": "python3.12-pulpcore-0:3.49.63-2.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.5 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42079", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "python3.12-pulpcore-0:3.49.63-2.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42082", "cpe": "cpe:/a:redhat:satellite:6.16::el8", "package": "python-pulpcore-0:3.49.39-2.el8pc", "product_name": "Red Hat Satellite 6.16 for RHEL 8", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42082", "cpe": "cpe:/a:redhat:satellite_capsule:6.16::el8", "package": "python-pulpcore-0:3.49.39-2.el8pc", "product_name": "Red Hat Satellite 6.16 for RHEL 8", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42082", "cpe": "cpe:/a:redhat:satellite:6.16::el9", "package": "python-pulpcore-0:3.49.39-2.el9pc", "product_name": "Red Hat Satellite 6.16 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42082", "cpe": "cpe:/a:redhat:satellite_capsule:6.16::el9", "package": "python-pulpcore-0:3.49.39-2.el9pc", "product_name": "Red Hat Satellite 6.16 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42150", "cpe": "cpe:/a:redhat:satellite:6.17::el9", "package": "python-pulpcore-0:3.63.21-2.el9pc", "product_name": "Red Hat Satellite 6.17 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42150", "cpe": "cpe:/a:redhat:satellite_capsule:6.17::el9", "package": "python-pulpcore-0:3.63.21-2.el9pc", "product_name": "Red Hat Satellite 6.17 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42151", "cpe": "cpe:/a:redhat:satellite:6.18::el9", "package": "python3.12-pulpcore-0:3.73.30-2.el9pc", "product_name": "Red Hat Satellite 6.18 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42151", "cpe": "cpe:/a:redhat:satellite_capsule:6.18::el9", "package": "python3.12-pulpcore-0:3.73.30-2.el9pc", "product_name": "Red Hat Satellite 6.18 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42240", "cpe": "cpe:/a:redhat:satellite:6.19::el9", "package": "python3.12-pulpcore-0:3.85.15-5.el9pc", "product_name": "Red Hat Satellite 6.19 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}, {"advisory": "RHSA-2026:42240", "cpe": "cpe:/a:redhat:satellite_capsule:6.19::el9", "package": "python3.12-pulpcore-0:3.85.15-5.el9pc", "product_name": "Red Hat Satellite 6.19 for RHEL 9", "release_date": "2026-07-20T00:00:00Z"}], "bugzilla": {"description": "pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport", "id": "2490703", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490703"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H", "status": "verified"}, "cwe": "CWE-22", "details": ["A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with \"/\" but fails to block directory traversal sequences such as \"../\" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., \"looking/normal/../../../../etc/shadow\") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation."], "mitigation": {"lang": "en:us", "value": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n1. If FilesystemExport was never configured on your deployment, you are not affected by this issue.\n2. If FilesystemExporters exist in the database, audit them for path traversal sequences (\"../\"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.\n3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.\n4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.\n5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation."}, "name": "CVE-2026-12701", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "python-pulpcore", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:rhui:4::el8", "fix_state": "Affected", "package_name": "python-pulpcore", "product_name": "Red Hat Update Infrastructure 4 for Cloud Providers"}, {"cpe": "cpe:/a:redhat:rhui:5::el9", "fix_state": "Affected", "package_name": "python-pulpcore-client", "product_name": "Red Hat Update Infrastructure 5"}], "public_date": "2026-07-20T13:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-12701\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12701"], "statement": "This vulnerability is rated as Important severity because an authenticated administrator can achieve arbitrary file write outside the intended export directory with fully attacker-controlled content. The FilesystemExport API is restricted to admin-level users (in Satellite, authenticated via SSL certificate; in standalone RBAC deployments, admin role only). The Pulp process runs as the \"pulp\" system user (not root), and file permission bits cannot be controlled by the attacker. However, the \"pulp\" user typically has write access to service-critical paths, and attack vectors such as cron.d entries (text-parsed, no exec bit required) or overwriting Pulp configuration remain viable depending on filesystem permissions and SELinux policy. Red Hat Satellite and Red Hat Ansible Automation Hub ship pulpcore and are affected. RHUI is not affected because end users do not have access to Pulp content creation APIs.", "threat_severity": "Important"}

{}