pulpcore EUVD-2026-69293

Two concrete prerequisites are required. First, the attacker must possess an authenticated account on the Pulp instance with content upload permissions - anonymous or read-only access is insufficient (CVSS PR:L). Second, the Pulp deployment must use local filesystem storage; the description explicitly names this as the enabling storage mode, and alternative backends are not confirmed to share the behavior. A third condition governs propagation: a separate victim user must actively browse to the uploaded file's URL (CVSS UI:R), making this a stored XSS requiring social engineering or phishing delivery to reach a privileged target. Factors limiting realistic exploitation: the upload-permission requirement is the most actionable gate; victims must follow attacker-supplied URLs rather than being passively targeted; and deployments not using local filesystem storage may be unaffected.

The CVSS 3.1 score of 5.4 (Medium) accurately reflects the two principal constraints: a low-privilege authenticated account with upload access is required (PR:L), and a separate victim user must visit the malicious file URL (UI:R). The scope change metric (S:C) is the most significant signal - successful exploitation executes attacker-controlled JavaScript under the host application's origin, enabling session hijacking, credential exfiltration, or lateral pivot against higher-privileged users on the same platform. No EPSS data is present in the provided input, preventing probability-of-exploitation quantification. The vulnerability is absent from CISA KEV, and no proof-of-concept code has been identified, placing exploitation likelihood in the lower tier absent additional intelligence. Real-world priority escalates sharply in multi-tenant deployments where external contributors or less-trusted teams hold upload permissions to Satellite or Automation Platform repositories - the upload-permission gate is the primary limiting factor and the most actionable control point. The local filesystem storage prerequisite may exclude a subset of deployments using cloud or object storage backends, though this has not been independently confirmed.

An attacker holding a contributor account (or a compromised low-privilege credential) uploads a file named harvest.svg containing a JavaScript payload that exfiltrates document.cookie to an attacker-controlled endpoint into a Pulp file-type repository. The attacker then crafts a phishing message to a platform administrator containing the direct file URL. When the administrator's browser requests the URL, pulpcore serves the SVG with content-type image/svg+xml and no attachment header; the browser renders it inline within the application's origin and executes the embedded script, delivering the administrator's session token to the attacker. No public exploit code for this specific vulnerability exists at time of analysis.