REDHAT-BUG-2490703: Path Traversal
A path traversal vulnerability was found in pulpcore's relativepathvalidator (pulpcore/app/serializers/fields.py). The validator only checks os.path.isabs() to block paths starting with "/", but does not block "../" directory traversal sequences anywhere in the path.
When a user creates content via POST /api/v3/content/file/files/ with a crafted relativepath (e.g., "looking/normal/../../../../etc/cron.d/backdoor"), the value passes validation and is stored in ContentArtifact.relativepath. During FilesystemExport (pulpcore/app/tasks/export.py), os.path.join(path, relativepath) resolves outside the export directory, and the raw artifact content (fully attacker-controlled) is written to the escaped path.
The process runs as the "pulp" system user. File permission bits cannot be set by the attacker. FilesystemExport is only accessible to admin-level users (SSL cert auth in Satellite, admin role in RBAC deployments).
Affected: pulpcore (all versions through current HEAD 3.110.0.dev) Fix: Not yet available (coordinating with upstream) Reporter: Martin Brodeur (independent security researcher) PSIRT Ticket: PSIRTSUPT-7617
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2490703?
The severity of REDHAT-BUG-2490703 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2490703?
To fix REDHAT-BUG-2490703, update to the latest version of Pulp Pulpcore where the issue has been resolved.
What type of vulnerability is REDHAT-BUG-2490703?
REDHAT-BUG-2490703 is a path traversal vulnerability.
What impact does REDHAT-BUG-2490703 have on Pulp Pulpcore security?
The impact of REDHAT-BUG-2490703 can allow an attacker to access unauthorized files due to improper input validation.
When was REDHAT-BUG-2490703 published?
REDHAT-BUG-2490703 was published on June 19, 2026.