CVE-2026-12701
Received Received - Intake

Path Traversal in Pulp Content Export

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Red Hat, Inc.

Description
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-12701
EUVD
EUVD-2026-45954

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
red_hat pulpcore to 3.110.0.dev (inc)
red_hat ansible_automation_platform to 2.5 (inc)
red_hat ansible_automation_platform to 2.6 (inc)
red_hat satellite to 6.16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in pulpcore where the relative_path_validator function only checks if paths start with a forward slash but fails to block directory traversal sequences like '../' anywhere in the path. Attackers can craft malicious paths that escape intended directories during FilesystemExport operations, allowing arbitrary file writes to any location accessible by the Pulp service user.

Detection Guidance

Check for suspicious file paths in Pulp's ContentArtifact.relative_path field containing '../' sequences. Review FilesystemExport operations for unexpected file writes outside intended directories. Audit API logs for POST requests to /api/v3/content/file/files/ with malicious relative_path values.

Impact Analysis

An authenticated administrator could exploit this to write malicious files to any writable location on the system, potentially leading to service compromise or further system exploitation. The attack requires admin privileges but could allow full system takeover if combined with other vulnerabilities.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to sensitive files. The path traversal flaw enables attackers to write arbitrary files to any location writable by the Pulp service user, which may include directories containing regulated data such as personal health information (HIPAA) or personal data (GDPR). Unauthorized file writes could lead to data breaches or unauthorized access, compromising confidentiality requirements.

Mitigation Strategies

Apply available Red Hat errata advisories (RHSA-2026:42078, RHSA-2026:42079, RHSA-2026:42082) for affected products. Restrict admin-level access to FilesystemExport operations. Monitor filesystem for unauthorized file writes by the 'pulp' user. Temporarily disable FilesystemExport until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart