A path traversal flaw in pulpcore’s content upload API allows an authenticated user who has repository privileges to provide a malicious 'file_url' value. The URL scheme validation incorrectly accepts 'file:' without double slashes, enabling the token to be interpreted by Python’s URL parser. The flaw permits absolute or relative path traversal sequences that read any file accessible to the Pulp server process, including the container registry’s cache signing private key. If the registry component is present, an attacker can use the leaked key to forge bearer tokens and gain full access to all private container repositories.

Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 (Cloud Providers) and Red Hat Update Infrastructure 5, as well as any deployment that incorporates pulpcore within these products. Version information is not provided in the CVE data; the vulnerability applies to all installations containing pulpcore until a patch is deployed.

The CVSS score is 8.1, indicating high severity with significant exploitation potential if an authenticated low‑privileged user supplies a specially crafted URL. The EPSS score is < 1%, suggesting a very low probability of exploitation at the current time, yet this does not diminish the risk since the flaw can exfiltrate critical authentication material and compromise the entire container registry ecosystem. Successful exploitation would enable file disclosure and unauthorized container repository access, potentially leading to further lateral movement or data exfiltration within the infrastructure.