EUVD-2026-45954
GHSA-j5cg-p988-g42q
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Network-reachable admin API (AV:N/AC:L) but administrator privileges required (PR:H); traversal writes outside Pulp's control boundary (S:C) enabling arbitrary file write with high integrity/availability and limited confidentiality impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
AnalysisAI
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Pulp administrator (CVSS PR:H) with the ability to (1) upload an artifact whose content the attacker controls and (2) invoke a FilesystemExport operation supplying a crafted relative_path containing embedded '../' traversal sequences. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mostly consistent toward high but not maximal real-world urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or credential-compromised Pulp administrator uploads an artifact whose bytes are a crafted cron job or SSH authorized_keys entry, then triggers a FilesystemExport with a relative_path such as 'a/b/../../../../etc/cron.d/pwn'. The traversal escapes the export directory and writes the attacker's content to a location owned by root-adjacent automation, achieving code execution or persistence as the system processes the planted file. … |
| Remediation | No vendor-released patch version is identified in the provided data - the references point to the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-12701) and Bugzilla 2490703 (https://bugzilla.redhat.com/show_bug.cgi?id=2490703) rather than to a tagged errata, so consult those pages for the fixed pulpcore/product builds and apply them once published (via dnf update for Satellite/RHUI or the AAP update channels). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployed instances of Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; restrict administrative access to the FilesystemExport feature to only essential operators and implement file system monitoring. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated r
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary she
Remote code execution in galaxy_ng's legacy role import API (v1) allows an authenticated user controlling a git reposito
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user,
Container privilege escalation in Red Hat Ansible Automation Platform 2 allows non-root users within affected container
Server-Side Request Forgery in AWX's GitHub webhook integration (Red Hat Ansible Automation Platform 2) enables a remote
Insufficient OAuth token invalidation in Ansible Lightspeed (part of Red Hat Ansible Automation Platform 2.x) allows a r
Path traversal in awxkit's YAML !include directive exposes arbitrary local files when a user imports a crafted YAML file
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today