CVE-2026-84232— Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84232
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Satellite 6 | - |
cpe:/a:redhat:satellite:6
|
|
| Red Hat | Red Hat Satellite 6 | - |
cpe:/a:redhat:satellite:6
|
|
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | - |
cpe:/a:redhat:rhui:4::el8
|
|
| Red Hat | Red Hat Update Infrastructure 5 | - |
cpe:/a:redhat:rhui:5::el9
|
|
| Red Hat | Red Hat Update Infrastructure 5 | - |
cpe:/a:redhat:rhui:5::el9
|
|
II. Public POCs for CVE-2026-84232
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84232
请登录查看更多情报信息。
Other References for CVE-2026-84232 (2)
Same Patch Batch · Red Hat · 2026-09-01 · 10 CVEs total
| CVE-2026-84268 | 8.8 HIGH | Gvfs: sftp: heap-based buffer overflow in read_reply() |
| CVE-2026-84218 | 8.1 HIGH | Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve |
| CVE-2026-49329 | 7.5 HIGH | Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language hea |
| CVE-2026-84233 | 7.0 HIGH | Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filena |
| CVE-2026-84269 | 6.5 MEDIUM | Gvfs: afp: heap-based buffer overflow in dsi read path |
| CVE-2026-11873 | 6.5 MEDIUM | Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java |
| CVE-2026-53682 | 5.3 MEDIUM | Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts |
| CVE-2026-84270 | 4.3 MEDIUM | Gvfs: mtp: out-of-bounds read in do_read() |
| CVE-2026-84267 | 4.3 MEDIUM | Gvfs: sftp: uninitialized heap disclosure in read_string() |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
-
CVE-2026-80179
Jwcrypto: jwcrypto: denial of service via malformed jwe toke -
CVE-2026-79717
Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url wi -
CVE-2026-12564
Automation-controller: automation-controller: kubernetes ser -
CVE-2026-19730
Podman: podman: quadlet install --replace non-truncating wri -
CVE-2026-44191
Ansible-lightspeed: visual studio code ansible lightspeed ex
Same vendor: Red Hat
-
CVE-2026-49329
Openshift/oauth-server: openshift/oauth-server: quadratic-ti -
CVE-2026-84270
Gvfs: mtp: out-of-bounds read in do_read() -
CVE-2026-84269
Gvfs: afp: heap-based buffer overflow in dsi read path -
CVE-2026-84267
Gvfs: sftp: uninitialized heap disclosure in read_string() -
CVE-2026-84268
Gvfs: sftp: heap-based buffer overflow in read_reply()
Same weakness: CWE-79
-
CVE-2026-19471
Rockwell Automation ArmorStart® LT Stored Cross-site scripti -
CVE-2026-7877
WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contribut -
CVE-2026-84193
LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP -
CVE-2026-84192
LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data -
CVE-2026-84191
LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields
V. Comments for CVE-2026-84232
No comments yet