The vulnerability is a path‑traversal flaw in Pulpcore’s relative_path_validator. The validator only blocks leading slashes but ignores directory traversal sequences such as "..", allowing an authenticated administrator to construct a relative path that escapes the export directory. Because the file content is supplied by the attacker, the flaw permits arbitrary file writes wherever the Pulp service user can write, potentially compromising the service or the host.

The affected platforms are Red Hat’s Ansible Automation Platform (versions 2, 2.5, 2.6), the Satellite service (versions 6.16 through 6.19) on RHEL 8 and 9, and Red Hat Update Infrastructure 4 and 5 for cloud providers. These products use the pulpcore engine for managing export operations.

The CVSS score of 9 indicates high severity, and the EPSS score of < 1% shows a very low but non‑zero exploitation probability; the issue is not listed in CISA’s KEV catalog. The flaw requires authenticated administrator access to the Pulp API, so compromise is limited to systems where such credentials exist. Exploitation would involve constructing a FilesystemExport with a malicious relative_path, writing a file such as "/etc/shadow", and then using the new file to achieve service compromise or further system‑level exploitation.