pulp-rpm CVE-2026-103870

Requires an authenticated principal with permission to sync or upload a distribution/kickstart tree into pulp-rpm (PR:L). The uploaded or synced tree's .treeinfo must contain addon or variant ids crafted with path-traversal sequences, and a publish task must then run against that tree. Exploitation is LIMITED by: (1) authentication and content-management privileges are mandatory - not exploitable anonymously; (2) it is create-only - an existing file or directory is NOT replaced, so arbitrary overwrite of existing content is not possible; (3) writes are confined to what the Pulp worker user account can write on the filesystem; (4) no confidentiality disclosure and no service disruption result. In Satellite 6 / RHUI 4 / RHUI 5 these sync/upload rights are normally held by trusted operators, narrowing the realistic attacker set.

This is a medium-severity, integrity-only path traversal (CWE-22) with a bounded real-world risk that is lower than the raw CVSS 5.0 might suggest. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) shows a network-reachable, low-complexity flaw with NO confidentiality impact, NO availability impact, and only LOW integrity impact, despite a scope change (S:C) reflecting writes outside the Pulp task work area. The decisive limiting signal is PR:L: exploitation requires an authenticated user who already holds sync-or-upload content-management privileges in pulp-rpm - in Satellite/RHUI deployments these are typically trusted operators/content managers, not anonymous internet users, so the AV:N network vector overstates exposure. Impact is further capped because the description states an existing file or directory is NOT replaced (create-only, no overwrite) and the write runs only with the Pulp worker user's filesystem permissions. No EPSS score, CISA KEV listing, POC, or SSVC data was provided in the input, so exploitation probability cannot be quantified; none of these signals claim active exploitation. Net: a legitimate but low-urgency patching priority - real but constrained, and gated behind authenticated content privileges rather than a widespread drive-by threat.

An attacker holding sync or upload rights in pulp-rpm uploads or syncs a distribution (kickstart) tree whose .treeinfo file lists addon or variant ids containing directory-traversal sequences (e.g. '../../'). When the publish task processes that tree, it uses those ids verbatim as directory names and creates new directories outside the task work area, writing repository metadata and packages there as the Pulp worker user. No public exploit identified at time of analysis; the attack leverages normal content-management permissions rather than a memory-corruption primitive.