CVE-2026-12701

Summary

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:3.49.63-2.el8ap < *unaffected
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:3.49.63-2.el9ap < *unaffected
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:3.49.63-2.el9ap < *unaffected
Red HatRed Hat Satellite 6.16 for RHEL 80:3.49.39-2.el8pc < *unaffected
Red HatRed Hat Satellite 6.16 for RHEL 80:3.49.39-2.el8pc < *unaffected
Red HatRed Hat Satellite 6.16 for RHEL 90:3.49.39-2.el9pc < *unaffected
Red HatRed Hat Satellite 6.16 for RHEL 90:3.49.39-2.el9pc < *unaffected
Red HatRed Hat Satellite 6.17 for RHEL 90:3.63.21-2.el9pc < *unaffected
Red HatRed Hat Satellite 6.17 for RHEL 90:3.63.21-2.el9pc < *unaffected
Red HatRed Hat Satellite 6.18 for RHEL 90:3.73.30-2.el9pc < *unaffected
Red HatRed Hat Satellite 6.18 for RHEL 90:3.73.30-2.el9pc < *unaffected
Red HatRed Hat Satellite 6.19 for RHEL 90:3.85.15-5.el9pc < *unaffected
Red HatRed Hat Satellite 6.19 for RHEL 90:3.85.15-5.el9pc < *unaffected

Weaknesses

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Workarounds

There is no complete mitigation for this vulnerability. The following measures can reduce risk:

  1. If FilesystemExport was never configured on your deployment, you are not affected by this issue.
  2. If FilesystemExporters exist in the database, audit them for path traversal sequences ("../"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.
  3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.
  4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.
  5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation.

References