CVE-2026-12701— Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
Affected Version Matrix 18
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12701
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
Source: CVE Program / CVE List V5
Vulnerability Description
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Pulp Project Pulp 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pulp project pulp是pulp project团队开源的一个软件包管理平台。 Pulp Project Pulp存在路径遍历漏洞，该漏洞源于relative_path_validator函数仅验证内容路径不以“/”开头，但未能阻止路径中的目录遍历序列（如“../”），经身份验证的管理员可在FilesystemExport操作期间构造包含嵌入遍历序列的relative_path，将用户控制的上传文件写入Pulp服务用户可写的任意位置，可能导致服务被入侵或进一步系统利用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:3.49.63-2.el8ap ~ * | cpe:/a:redhat:ansible_automation_platform:2.5::el8 | |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:3.49.63-2.el9ap ~ * | cpe:/a:redhat:ansible_automation_platform:2.5::el8 | |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:3.49.63-2.el9ap ~ * | cpe:/a:redhat:ansible_automation_platform:2.6::el10 | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:3.49.39-2.el8pc ~ * | cpe:/a:redhat:satellite:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:3.49.39-2.el8pc ~ * | cpe:/a:redhat:satellite:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:3.49.39-2.el9pc ~ * | cpe:/a:redhat:satellite:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:3.49.39-2.el9pc ~ * | cpe:/a:redhat:satellite:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.63.21-2.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.63.21-2.el9pc ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:3.73.30-2.el9pc ~ * | cpe:/a:redhat:satellite:6.18::el9 | |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:3.73.30-2.el9pc ~ * | cpe:/a:redhat:satellite:6.18::el9 | |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.85.15-5.el9pc ~ * | cpe:/a:redhat:satellite:6.19::el9 | |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.85.15-5.el9pc ~ * | cpe:/a:redhat:satellite:6.19::el9 | |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1783979593 ~ * | cpe:/a:redhat:ansible_automation_platform:2.6::el9 | |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1783919521 ~ * | cpe:/a:redhat:ansible_automation_platform:2.7::el9 | |
| Red Hat | Red Hat Ansible Automation Platform 2 | - | cpe:/a:redhat:ansible_automation_platform:2 | |
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | - | cpe:/a:redhat:rhui:4::el8 | |
| Red Hat | Red Hat Update Infrastructure 5 | - | cpe:/a:redhat:rhui:5::el9 |
II. Public POCs for CVE-2026-12701
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12701
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12701 (9)
- 🔗 RHSA-2026:42142 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisoryx_refsource_REDHAT
- 🔗 RHSA-2026:42151 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisoryx_refsource_REDHAT
- 🔗 RHSA-2026:42079 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisoryx_refsource_REDHAT
- 🔗 RHSA-2026:42078 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisoryx_refsource_REDHAT
- 🔗 RHSA-2026:42132 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisoryx_refsource_REDHAT
Other References for CVE-2026-12701 (1)
Same Patch Batch · Red Hat · 2026-07-20 · 8 CVEs total
| CVE-2026-16242 | 9.4 CRITICAL | Hypershift: konnectivity proxy-server accepts agent connections without validating client |
| CVE-2026-64612 | 7.5 HIGH | Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malforme |
| CVE-2026-12080 | 7.3 HIGH | Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add |
| CVE-2026-15813 | 6.5 MEDIUM | Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network pac |
| CVE-2026-16277 | 6.5 MEDIUM | Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist() |
| CVE-2026-15588 | 5.3 MEDIUM | Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering |
| CVE-2026-16254 | 4.3 MEDIUM | Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk install |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2026-12382
Aap-gateway: missing requestheaderstoremove allows mtls bypa - CVE-2026-11807
Eda-server: websocket missing authorization allows credentia - CVE-2026-11332
Ansible-core: argument injection in ansible-galaxy role inst - CVE-2026-6266
Aap-controller: aap-gateway: account hijacking and unauthori - CVE-2025-9909
Aap-gateway: improper path validation in gateway allows cred
Same vendor: Red Hat
- CVE-2026-12353
Rhcs: memory leak during https connection leads to denial of - CVE-2026-16768
Gdk-pixbuf: out-of-bounds read in ico parser - CVE-2026-64611
Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion - CVE-2026-16745
Odh-dashboard: odh-dashboard: backend port 8080 trusts x-for - CVE-2026-6390
Nano: gnu nano: arbitrary memory writes, information disclos
Same weakness: CWE-22
- CVE-2026-16767
Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal - CVE-2026-65694
Microweber CMS 2.0.20 Path Traversal via ServeStaticFileCont - CVE-2026-47669
DbGate: Zip Slip in archive/unzip allows arbitrary file writ - CVE-2026-15687
Path traversal via non-tar copyDirectoryFromPod - CVE-2026-65920
Diffusers Path Traversal via weight_map Arbitrary File Read
V. Comments for CVE-2026-12701
No comments yet