CVE-2026-12701

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Jul 20, 2026
Source updated: Oct 8, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Red Hat Ansible Automation Platform 2.5 for RHEL 8

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
Platforms: Unknown
Default status: affected
Package: python3.12-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.49.63-2.el8ap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Ansible Automation Platform 2.5 for RHEL 9

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2.5 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python3.12-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.49.63-2.el9ap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Ansible Automation Platform 2.6 for RHEL 9

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2.6 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python3.12-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.49.63-2.el9ap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.16 for RHEL 8

Vendor: Red Hat
Product: Red Hat Satellite 6.16 for RHEL 8
Platforms: Unknown
Default status: affected
Package: python-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.16 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.49.39-2.el8pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.16 for RHEL 8

Vendor: Red Hat
Product: Red Hat Satellite 6.16 for RHEL 8
Platforms: Unknown
Default status: affected
Package: python-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.16 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.49.39-2.el8pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.16 for RHEL 9

Vendor: Red Hat
Product: Red Hat Satellite 6.16 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.16 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.49.39-2.el9pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.16 for RHEL 9

Vendor: Red Hat
Product: Red Hat Satellite 6.16 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.16 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.49.39-2.el9pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.17 for RHEL 9

Vendor: Red Hat
Product: Red Hat Satellite 6.17 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.17 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.63.21-2.el9pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.17 for RHEL 9

Vendor: Red Hat
Product: Red Hat Satellite 6.17 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.17 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.63.21-2.el9pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.18 for RHEL 9

Vendor: Red Hat
Product: Red Hat Satellite 6.18 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python3.12-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.18 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.73.30-2.el9pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.18 for RHEL 9

Vendor: Red Hat
Product: Red Hat Satellite 6.18 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python3.12-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.18 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.73.30-2.el9pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.19 for RHEL 9

Vendor: Red Hat
Product: Red Hat Satellite 6.19 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python3.12-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.19 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.85.15-5.el9pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Satellite 6.19 for RHEL 9

Vendor: Red Hat
Product: Red Hat Satellite 6.19 for RHEL 9
Platforms: Unknown
Default status: affected
Package: python3.12-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Satellite 6.19 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.85.15-5.el9pc	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Ansible Automation Platform 2.6

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2.6
Platforms: Unknown
Default status: affected
Package: ansible-automation-platform-26/hub-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Ansible Automation Platform 2.6 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1783979593	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Ansible Automation Platform 2.7

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2.7
Platforms: Unknown
Default status: affected
Package: ansible-automation-platform-27/hub-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Ansible Automation Platform 2.7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1783919521	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Ansible Automation Platform 2

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2
Platforms: Unknown
Default status: unaffected
Package: python-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Update Infrastructure 4 for Cloud Providers

Vendor: Red Hat
Product: Red Hat Update Infrastructure 4 for Cloud Providers
Platforms: Unknown
Default status: affected
Package: python-pulpcore
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Update Infrastructure 5

Vendor: Red Hat
Product: Red Hat Update Infrastructure 5
Platforms: Unknown
Default status: affected
Package: python-pulpcore-client
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.