EUVD-2026-69293
GHSA-jgq4-584p-wwmw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable stored XSS requiring low-privilege upload access and active victim interaction; scope change reflects JavaScript executing in victim browser at host origin.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
AnalysisAI
Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.4 (Medium) accurately reflects the two principal constraints: a low-privilege authenticated account with upload access is required (PR:L), and a separate victim user must visit the malicious file URL (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch availability and exact fixed versions must be verified directly against the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-84232 and the associated Bugzilla tracking entry at https://bugzilla.redhat.com/show_bug.cgi?id=2526807 - no specific patched package version is present in the currently available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated r
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary she
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2:
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated
Remote code execution in galaxy_ng's legacy role import API (v1) allows an authenticated user controlling a git reposito
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user,
Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today