CVE-2026-12701: Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
Other sources
A path traversal vulnerability was found in pulpcore's relativepathvalidator (pulpcore/app/serializers/fields.py). The validator only checks os.path.isabs() to block paths starting with "/", but does not block "../" directory traversal sequences anywhere in the path.
When a user creates content via POST /api/v3/content/file/files/ with a crafted relativepath (e.g., "looking/normal/../../../../etc/cron.d/backdoor"), the value passes validation and is stored in ContentArtifact.relativepath. During FilesystemExport (pulpcore/app/tasks/export.py), os.path.join(path, relativepath) resolves outside the export directory, and the raw artifact content (fully attacker-controlled) is written to the escaped path.
The process runs as the "pulp" system user. File permission bits cannot be set by the attacker. FilesystemExport is only accessible to admin-level users (SSL cert auth in Satellite, admin role in RBAC deployments).
Affected: pulpcore (all versions through current HEAD 3.110.0.dev) Fix: Not yet available (coordinating with upstream) Reporter: Martin Brodeur (independent security researcher) PSIRT Ticket: PSIRTSUPT-7617
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12701?
CVE-2026-12701 has a critical severity rating of 9.
How do I fix CVE-2026-12701?
To fix CVE-2026-12701, update to the latest version of pulpcore that addresses the path traversal vulnerability.
What type of vulnerability is CVE-2026-12701?
CVE-2026-12701 is a path traversal vulnerability that allows bypassing the relative_path_validator function.
Who is affected by CVE-2026-12701?
Authenticated administrators using pulpcore may be affected by CVE-2026-12701 due to the path traversal issue.
What can an attacker do with CVE-2026-12701?
An attacker could exploit CVE-2026-12701 to access unauthorized files on the server by crafting a malicious content path.