CVE-2026-12701— Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
pulp project pulp是pulp project团队开源的一个软件包管理平台。 Pulp Project Pulp存在路径遍历漏洞，该漏洞源于relative_path_validator函数仅验证内容路径不以“/”开头，但未能阻止路径中的目录遍历序列（如“../”），经身份验证的管理员可在FilesystemExport操作期间构造包含嵌入遍历序列的relative_path，将用户控制的上传文件写入Pulp服务用户可写的任意位置，可能导致服务被入侵或进一步系统利用。
Affected Version Matrix 18
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12701
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
Source: CVE Program / CVE List V5
Vulnerability Description
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Pulp Project Pulp 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pulp project pulp是pulp project团队开源的一个软件包管理平台。 Pulp Project Pulp存在路径遍历漏洞，该漏洞源于relative_path_validator函数仅验证内容路径不以“/”开头，但未能阻止路径中的目录遍历序列（如“../”），经身份验证的管理员可在FilesystemExport操作期间构造包含嵌入遍历序列的relative_path，将用户控制的上传文件写入Pulp服务用户可写的任意位置，可能导致服务被入侵或进一步系统利用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:3.49.63-2.el8ap ~ * |
cpe:/a:redhat:ansible_automation_platform:2.5::el8
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:3.49.63-2.el9ap ~ * |
cpe:/a:redhat:ansible_automation_platform:2.5::el8
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:3.49.63-2.el9ap ~ * |
cpe:/a:redhat:ansible_automation_platform:2.6::el10
|
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:3.49.39-2.el8pc ~ * |
cpe:/a:redhat:satellite:6.16::el8
|
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:3.49.39-2.el8pc ~ * |
cpe:/a:redhat:satellite:6.16::el8
|
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:3.49.39-2.el9pc ~ * |
cpe:/a:redhat:satellite:6.16::el8
|
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:3.49.39-2.el9pc ~ * |
cpe:/a:redhat:satellite:6.16::el8
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.63.21-2.el9pc ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.63.21-2.el9pc ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:3.73.30-2.el9pc ~ * |
cpe:/a:redhat:satellite:6.18::el9
|
|
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:3.73.30-2.el9pc ~ * |
cpe:/a:redhat:satellite:6.18::el9
|
|
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.85.15-5.el9pc ~ * |
cpe:/a:redhat:satellite:6.19::el9
|
|
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.85.15-5.el9pc ~ * |
cpe:/a:redhat:satellite:6.19::el9
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1783979593 ~ * |
cpe:/a:redhat:ansible_automation_platform:2.6::el9
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1783919521 ~ * |
cpe:/a:redhat:ansible_automation_platform:2.7::el9
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | - |
cpe:/a:redhat:rhui:4::el8
|
|
| Red Hat | Red Hat Update Infrastructure 5 | - |
cpe:/a:redhat:rhui:5::el9
|
|
II. Public POCs for CVE-2026-12701
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12701
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12701 (10)
-
-
-
🔗 RHSA-2026:42142 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:42151 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
🔗 RHSA-2026:42079 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
-
🔗 RHSA-2026:42078 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:42132 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-07-20 · 8 CVEs total
| CVE-2026-16242 | 9.4 CRITICAL | Hypershift: konnectivity proxy-server accepts agent connections without validating client |
| CVE-2026-64612 | 7.5 HIGH | Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malforme |
| CVE-2026-12080 | 7.3 HIGH | Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add |
| CVE-2026-15813 | 6.5 MEDIUM | Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network pac |
| CVE-2026-16277 | 6.5 MEDIUM | Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist() |
| CVE-2026-15588 | 5.3 MEDIUM | Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering |
| CVE-2026-16254 | 4.3 MEDIUM | Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk install |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
-
CVE-2026-84724
Automation-controller: automation-controller: systemjob extr -
CVE-2026-84720
Automation-controller: automation-controller: workflowjobnod -
CVE-2026-84718
Automation-controller: automation-controller: client ip spoo -
CVE-2026-84717
Automation-controller: automation-controller: unauthenticate -
CVE-2026-84716
Automation-controller: automation-controller: instance insta
Same vendor: Red Hat
-
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc
Same weakness: CWE-22
-
CVE-2026-104853
Nx: Path traversal in nx migrate package-migrations extracti -
CVE-2026-103648
Improper Limitation of a Pathname to a Restricted Directory -
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction -
CVE-2026-104721
Logback: Incomplete protection against CVE-2026-19880 -
CVE-2026-104417
Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
V. Comments for CVE-2026-12701
No comments yet