CVE-2026-84232
Received Received - Intake

Stored XSS in Pulp Content Serving Application

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: redhat-SADP

Description
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84232
EUVD
EUVD-2026-69293

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pulpproject pulpcore *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in pulpcore's content serving application. Files like HTML or SVG uploaded to Pulp repositories are served with their original content type and without security headers. When users access these file URLs, malicious JavaScript embedded in the files executes in their browser, allowing attackers to perform actions on their behalf.

Detection Guidance

Check Pulp file-type repositories for uploaded HTML or SVG files with JavaScript content. Inspect the /pulp/content/ path for files served without security headers like Content-Disposition or X-Content-Type-Options. Use browser developer tools to examine response headers and content types for mismatches.

Impact Analysis

An attacker with upload permissions can trick authenticated users into visiting a malicious file URL. The script can read page content, make authenticated API requests, and perform actions like a logged-in user. While session cookies are protected, attackers can still perform actions via AJAX requests. The impact is limited to active browser sessions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (patient data confidentiality) if exploited. It may result in data breaches or unauthorized actions, requiring organizations to assess exposure and apply mitigations to maintain compliance.

Mitigation Strategies

Add security headers (Content-Disposition: attachment, X-Content-Type-Options: nosniff) to the Apache reverse proxy for the /pulp/content/ path. Restrict file upload permissions to trusted users only. Update pulpcore to the latest version if available. Monitor uploaded files for malicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart