CVE-2026-90959
Received Received - Intake

Path Traversal in Pulp Content Upload API

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description
A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-90959
EUVD
EUVD-2026-85920

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
pulpproject pulpcore *
red_hat pulpcore 3.117.1
red_hat pulp_container 2.29.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90959 is a path traversal vulnerability in pulpcore, a component of Red Hat's Pulp software. It exists in the content upload API which accepts a 'file_url' parameter. The issue stems from a mismatch between URL scheme validation and Python's URL parser. The validator only rejects URLs starting with 'file://', but the parser also accepts 'file:' without double slashes. This allows an authenticated low-privilege user to craft a URL with relative path traversal sequences to read any file accessible to the Pulp server process.

In deployments with Pulp Container, exploitation enables reading the container registry token signing private key and forging bearer tokens, granting unauthorized access to all private container repositories.

Detection Guidance

To detect this vulnerability, check if your pulpcore instance is running a vulnerable version (3.117.1 or pulp-container 2.29.0) and if the content upload API is enabled. Review logs for unusual file access patterns or requests containing 'file:' URLs with path traversal sequences like '../'.

Impact Analysis

An attacker with low-privilege repository permissions could read sensitive files on the Pulp server, including configuration files or secrets. If Pulp Container is deployed, attackers could steal the registry signing key and forge tokens to gain unauthorized access to private container repositories. This could lead to data theft, unauthorized image manipulation, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of personal or health data through file access or container registry breaches may result in compliance violations, regulatory penalties, and loss of trust. Organizations must address this to maintain data protection standards.

Mitigation Strategies

Immediately restrict repository creator privileges to trusted users only. Disable the 'file_url' parameter in the content upload API if not required. Monitor for unauthorized access to sensitive files like the container registry token signing key.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart