Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103870— Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

Quick assessment

Affected
Red Hat Red Hat Satellite 6
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 pulp-rpm 发布分布树（distribution tree）时存在一个缺陷。系统会使用 文件中的 addon 和 variant ID 作为目录名。具有同步或上传该树权限的用户可以导致发布任务在工作区之外创建新目录，并以 Pulp 工作进程用户的身份将树的仓库元数据和包写入这些目录中。已存在的文件或目录不会被替换。此缺陷不会导致数据泄露，也不会导致服务中断。

CVSS 5.0 · Medium

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103870

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pulp-rpm: distribution tree publish creates directories from .treeinfo ids
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Satellite 6 - cpe:/a:redhat:satellite:6
Red Hat Red Hat Satellite 6 - cpe:/a:redhat:satellite:6
Red Hat Red Hat Update Infrastructure 4 for Cloud Providers - cpe:/a:redhat:rhui:4::el8
Red Hat Red Hat Update Infrastructure 4 for Cloud Providers - cpe:/a:redhat:rhui:4::el8
Red Hat Red Hat Update Infrastructure 5 - cpe:/a:redhat:rhui:5::el9
Red Hat Red Hat Update Infrastructure 5 - cpe:/a:redhat:rhui:5::el9
Red Hat Red Hat Update Infrastructure 5 - cpe:/a:redhat:rhui:5::el9

II. Public POCs for CVE-2026-103870

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103870

请登录查看更多情报信息。

Other References for CVE-2026-103870 (2)

Same Patch Batch · Red Hat · 2026-10-07 · 6 CVEs total

CVE-2026-106471 8.1 HIGH Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter mult
CVE-2026-107121 6.5 MEDIUM Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downg
CVE-2026-103869 6.5 MEDIUM Pulp-ansible: bearer tokens are reused across remotes in a worker
CVE-2026-103868 6.5 MEDIUM Pulp-container: registry credentials are reused across remotes in a worker
CVE-2026-106061 5.5 MEDIUM Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file

IV. Related Vulnerabilities

Same product: Red Hat Satellite 6
Same vendor: Red Hat
Same weakness: CWE-22

V. Comments for CVE-2026-103870

No comments yet

Leave a comment