Skip to content
Fencer Vulns
critical 9.0

CVE-2026-12701 json

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

published 2026-07-20 3 mo ago modified 2026-11-02 6 d ago also EUVD-2026-45954

cvss
9.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Patch / fix

  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:3.49.63-2.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:3.49.63-2.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:3.49.63-2.el9ap
  • Red Hat Red Hat Satellite 6.16 for RHEL 8 0:3.49.39-2.el8pc
  • Red Hat Red Hat Satellite 6.16 for RHEL 9 0:3.49.39-2.el9pc
  • Red Hat Red Hat Satellite 6.17 for RHEL 9 0:3.63.21-2.el9pc
  • Red Hat Red Hat Satellite 6.18 for RHEL 9 0:3.73.30-2.el9pc
  • Red Hat Red Hat Satellite 6.19 for RHEL 9 0:3.85.15-5.el9pc
  • Red Hat Red Hat Ansible Automation Platform 2.6 1783979593
  • Red Hat Red Hat Ansible Automation Platform 2.7 1783919521
  • python3.12-pulpcore satellite capsule 6.19, satellite 6.19 3.85.15-5.el9pc
  • yggdrasil-worker-forwarder satellite 6.19, satellite 6.18, satellite 6.17 +1 more 0.0.4-1.el9sat
  • python-pulpcore satellite capsule 6.17, satellite 6.17 3.63.21-2.el9pc
  • python3.11-pulpcore satellite capsule 6.17, satellite 6.17 3.63.21-2.el9pc
  • python3.12-pulpcore satellite capsule 6.18, satellite 6.18 3.73.30-2.el9pc
  • python-pulpcore satellite capsule 6.16, satellite 6.16 3.49.39-2.el8pc
  • python-pulpcore satellite capsule 6.16, satellite 6.16 3.49.39-2.el9pc
  • python3.11-pulpcore satellite capsule 6.16, satellite 6.16 3.49.39-2.el8pc

red hat advisories RHSA-2026:42240RHSA-2026:42150RHSA-2026:42151RHSA-2026:42082RHSA-2026:42079RHSA-2026:42078

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-12701 updated cvss 9.0

pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport

  • Red Hat Update Infrastructure 4 for Cloud Providers python-pulpcore 3.28.37-1.el9ap
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Update Infrastructure 5 python-pulpcore-client
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-pulpcore 3.49.63-2.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-pulpcore 3.49.63-2.el9ap
    fixed: vendor fix RHSA-2026:42078
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1783979593
    fixed: vendor fix RHSA-2026:42132
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-pulpcore 3.49.63-2.el9ap
    fixed: vendor fix RHSA-2026:42079
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1783919521
    fixed: vendor fix RHSA-2026:42142
  • Red Hat Satellite 6.16 for RHEL 8 python-pulpcore 3.49.39-2.el8pc, python3.11-pulpcore 3.49.39-2.el8pc Red Hat Satellite 6.16 for RHEL 9 python-pulpcore 3.49.39-2.el9pc, python3.11-pulpcore 3.49.39-2.el9pc
    fixed: vendor fix RHSA-2026:42082
  • Red Hat Satellite 6.17 for RHEL 9 python-pulpcore 3.63.21-2.el9pc, python3.11-pulpcore 3.63.21-2.el9pc
    fixed: vendor fix RHSA-2026:42150
show 3 more
  • Red Hat Satellite 6.18 for RHEL 9 python3.12-pulpcore 3.73.30-2.el9pc
    fixed: vendor fix RHSA-2026:42151
  • Red Hat Satellite 6.19 for RHEL 9 python3.12-pulpcore 3.85.15-5.el9pc
    fixed: vendor fix RHSA-2026:42240
  • Red Hat Ansible Automation Platform 2 python-pulpcore 3.28.37-1.el9ap Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.6-1.el8ap, receptorctl 1.6.6-1.el8ap, ansible-core 2.16.19-1.el8ap, ansible-test 2.16.19-1.el8ap, automation-hub 4.10.16-1.el8ap, python3.12-pyjwt 2.13.0-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.6-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-core 2.16.19-1.el9ap, ansible-test 2.16.19-1.el9ap, automation-hub 4.10.16-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, +20 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1783969842, ansible-automation-platform-26/hub-web-rhel9 1783982443, ansible-automation-platform-26/receptor-rhel9 1783962464, ansible-automation-platform-26/mcp-tools-rhel9 1783920640, ansible-automation-platform-26/controller-rhel9 1783973764, ansible-automation-platform-26/de-minimal-rhel9 1783921549, +24 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.6-1.el9ap, molecule 26.6.0-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-sign 0.1.6-1.el9ap, ansible-lint 26.6.0-1.el9ap, ansible-core 2.16.19-1.el9ap, +39 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.6-1.el10ap, molecule 26.6.0-1.el10ap, receptorctl 1.6.6-1.el10ap, ansible-sign 0.1.6-1.el10ap, ansible-lint 26.6.0-1.el10ap, ansible-core 2.16.19-1.el10ap, +9 more
    +6 more products
    Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1783919486, ansible-automation-platform-27/hub-web-rhel9 1783921568, ansible-automation-platform-27/receptor-rhel9 1783917963, ansible-automation-platform-27/mcp-tools-rhel9 1783918403, ansible-automation-platform-27/controller-rhel9 1783921344, ansible-automation-platform-27/de-minimal-rhel9 1783918892, +25 more Red Hat Satellite 6.16 for RHEL 8 satellite 6.16.11-1.el8sat, satellite-cli 6.16.11-1.el8sat, satellite-common 6.16.11-1.el8sat, satellite-capsule 6.16.11-1.el8sat, yggdrasil-worker-forwarder 0.0.4-1.el8sat Red Hat Satellite 6.16 for RHEL 9 satellite 6.16.11-1.el9sat, satellite-cli 6.16.11-1.el9sat, satellite-common 6.16.11-1.el9sat, satellite-capsule 6.16.11-1.el9sat, yggdrasil-worker-forwarder 0.0.4-1.el9sat Red Hat Satellite 6.17 for RHEL 9 satellite 6.17.9.1-1.el9sat, python-pulp-rpm 3.27.12-1.el9pc, satellite-cli 6.17.9.1-1.el9sat, satellite-common 6.17.9.1-1.el9sat, python3.11-pulp-rpm 3.27.12-1.el9pc, satellite-capsule 6.17.9.1-1.el9sat, +2 more Red Hat Satellite 6.18 for RHEL 9 satellite 6.18.7.1-1.el9sat, satellite-cli 6.18.7.1-1.el9sat, satellite-common 6.18.7.1-1.el9sat, satellite-capsule 6.18.7.1-1.el9sat, yggdrasil-worker-forwarder 0.0.4-1.el9sat, satellite-obsolete-packages 6.18.7.1-1.el9sat Red Hat Satellite 6.19 for RHEL 9 satellite 6.19.2.1-1.el9sat, satellite-cli 6.19.2.1-1.el9sat, satellite-common 6.19.2.1-1.el9sat, satellite-capsule 6.19.2.1-1.el9sat, yggdrasil-worker-forwarder 0.0.4-1.el9sat, satellite-obsolete-packages 6.19.2.1-1.el9sat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.0 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Red Hat Satellite 6.19 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Update Infrastructure 4 for Cloud Providers
  • Red Hat Red Hat Update Infrastructure 5

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.