CVE-2026-12701

high Red Hat
CVSS v3 Base Score
9.0
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Published: July 20, 2026 (48 days ago)
Last Modified: July 20, 2026
Vendor: Red Hat
Fix Available: ✓ Yes
Source: REDHAT

Description

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

CWE

CWE-22

Affected Products

Red Hat Ansible Automation Platform 2Red Hat Update Infrastructure 4 for Cloud ProvidersRed Hat Update Infrastructure 5Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat Satellite 6.16 for RHEL 8Red Hat Satellite 6.16 for RHEL 9Red Hat Satellite 6.17 for RHEL 9Red Hat Satellite 6.18 for RHEL 9

Fix Status

✅ Fix Available

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov