A path traversal vulnerability was found in pulpcore's relativepathvalidator (pulpcore/app/serializers/fields.py). The validator only checks os.path.isabs() to block paths starting with "/", but does not block "../" directory traversal sequences anywhere in the path.

When a user creates content via POST /api/v3/content/file/files/ with a crafted relativepath (e.g., "looking/normal/../../../../etc/cron.d/backdoor"), the value passes validation and is stored in ContentArtifact.relativepath. During FilesystemExport (pulpcore/app/tasks/export.py), os.path.join(path, relativepath) resolves outside the export directory, and the raw artifact content (fully attacker-controlled) is written to the escaped path.

The process runs as the "pulp" system user. File permission bits cannot be set by the attacker. FilesystemExport is only accessible to admin-level users (SSL cert auth in Satellite, admin role in RBAC deployments).

Affected: pulpcore (all versions through current HEAD 3.110.0.dev) Fix: Not yet available (coordinating with upstream) Reporter: Martin Brodeur (independent security researcher) PSIRT Ticket: PSIRTSUPT-7617