What is the CVSS score of EUVD-2026-45954?

EUVD-2026-45954 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Pulp (pulpcore) are affected by EUVD-2026-45954?

Pulpcore-embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure-contains a critical arbitrary file-write vulnerability that allows privileged administrators to…. A patch is available.

How to fix or mitigate EUVD-2026-45954?

Within 24 hours, inventory all deployed instances of Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; restrict administrative access to the FilesystemExport feature to only essential operators and implement file system monitoring. Within 7 days, either disable the FilesystemExport feature entirely through platform configuration if operationally feasible or isolate affected systems to a restricted network segment and review/revoke unnecessary administrative accounts. Within 30 days, monitor Red Hat security advisories for patch availability; conduct testing in a staging environment immediately upon release; and deploy the vendor patch to all affected production systems per your change control process.

Pulp (pulpcore) EUVD-2026-45954

| CVE-2026-12701 CRITICAL

Path Traversal (CWE-22)

2026-07-20 redhat

GHSA-j5cg-p988-g42q

Path Traversal Red Hat Red Hat Satellite 6 Red Hat Ansible Automation Platform 2 Red Hat Update Infrastructure 4 For Cloud Providers Red Hat Update Infrastructure 5 Red Hat

9.0

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network-reachable admin API (AV:N/AC:L) but administrator privileges required (PR:H); traversal writes outside Pulp's control boundary (S:C) enabling arbitrary file write with high integrity/availability and limited confidentiality impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:00 vuln.today

CVE Published

Jul 20, 2026 - 14:18 cve.org

CRITICAL 9.0

DescriptionCVE.org

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

AnalysisAI

Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. Rated CVSS 9.0 and reported by Red Hat, it affects pulpcore as embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; there is no public exploit identified at time of analysis.

Technical ContextAI

Pulp (pulpcore) is a Python-based content-management platform that stores and publishes software artifacts (RPMs, container images, Ansible content) and underpins several Red Hat products. The defect is a CWE-22 Improper Limitation of a Pathname to a Restricted Directory: the relative_path_validator function enforces only that a path does not start with '/', treating that single check as sufficient sanitization. It never normalizes or rejects '../' segments occurring elsewhere in the string, so a value like 'looking/normal/../../../../etc/shadow' passes validation and, during a FilesystemExport operation, resolves outside the designated export root. Combined with attacker-controlled artifact bytes, the traversal converts an intended in-directory write into an arbitrary-location write bounded only by the Pulp service account's filesystem permissions.

RemediationAI

No vendor-released patch version is identified in the provided data - the references point to the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-12701) and Bugzilla 2490703 (https://bugzilla.redhat.com/show_bug.cgi?id=2490703) rather than to a tagged errata, so consult those pages for the fixed pulpcore/product builds and apply them once published (via dnf update for Satellite/RHUI or the AAP update channels). As compensating controls until patched: restrict and audit who holds Pulp administrator/export privileges, since exploitation requires PR:H; avoid or disable FilesystemExport where it is not operationally needed, accepting the trade-off that legitimate filesystem exports will stop working; constrain the Pulp service user's filesystem permissions and consider SELinux confinement so that even a successful traversal cannot write to sensitive paths like /etc; and monitor export requests for relative_path values containing '../' sequences. Network-restrict the Pulp admin API to trusted management segments to reduce the exposure implied by the AV:N vector.