תיאור (מקור, אנגלית)
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
קישורים10
- access.redhat.com/errata/RHSA-2026:42078
- access.redhat.com/errata/RHSA-2026:42079
- access.redhat.com/errata/RHSA-2026:42082
- access.redhat.com/errata/RHSA-2026:42132
- access.redhat.com/errata/RHSA-2026:42142
- access.redhat.com/errata/RHSA-2026:42150
- access.redhat.com/errata/RHSA-2026:42151
- access.redhat.com/errata/RHSA-2026:42240
- access.redhat.com/security/cve/CVE-2026-12701
- bugzilla.redhat.com/show_bug.cgi?id=2490703
מדדים
- CVSS 3.1
-
9.0
CRITICAL
מקור הציון: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H - EPSS — סבירות ניצול
- 1% אחוזון 69 · נכון ל-14 בנובמבר 2026
- CWE
- CWE-22
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.