{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12701","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","state":"PUBLISHED","assignerShortName":"redhat","dateReserved":"2026-06-19T09:53:04.810Z","datePublished":"2026-07-20T14:18:18.318Z","dateUpdated":"2026-07-22T18:13:49.559Z"},"containers":{"cna":{"title":"Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport","metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with \"/\" but fails to block directory traversal sequences such as \"../\" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., \"looking/normal/../../../../etc/shadow\") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.49.63-2.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.49.63-2.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.49.63-2.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.49.39-2.el8pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.49.39-2.el8pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.49.39-2.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.49.39-2.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.63.21-2.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.63.21-2.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.73.30-2.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.73.30-2.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.19 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.85.15-5.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.19 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","defaultStatus":"affected","versions":[{"version":"0:3.85.15-5.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/hub-rhel9","defaultStatus":"affected","versions":[{"version":"1783979593","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/hub-rhel9","defaultStatus":"affected","versions":[{"version":"1783919521","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 4 for Cloud Providers","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhui:4::el8"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore-client","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhui:5::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:42078","name":"RHSA-2026:42078","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42079","name":"RHSA-2026:42079","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42082","name":"RHSA-2026:42082","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42132","name":"RHSA-2026:42132","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42142","name":"RHSA-2026:42142","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42150","name":"RHSA-2026:42150","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42151","name":"RHSA-2026:42151","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42240","name":"RHSA-2026:42240","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12701","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490703","name":"RHBZ#2490703","tags":["issue-tracking","x_refsource_REDHAT"]}],"datePublic":"2026-07-20T13:00:00.000Z","problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","workarounds":[{"lang":"en","value":"There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If FilesystemExport was never configured on your deployment, you are not affected by this issue.\n2. If FilesystemExporters exist in the database, audit them for path traversal sequences (\"../\"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.\n3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.\n4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.\n5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation."}],"timeline":[{"lang":"en","time":"2026-04-24T02:44:10.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-07-20T13:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Martin Brodeur (Independent security researcher) for reporting this issue."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-07-22T11:36:09.742Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-22T18:13:39.913416Z","id":"CVE-2026-12701","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-22T18:13:49.559Z"}}]}}