Executive brief
A security vulnerability exists in pulpcore, a component used for managing and distributing software packages in products like Red Hat Satellite and Ansible Automation Platform. An administrator with high-level access can bypass security checks to write malicious files to any location on the server's filesystem that the application can access. This could allow an attacker to compromise the entire server, disrupt operations, or gain unauthorized access to sensitive system files.
Technical details
A path traversal vulnerability exists in the 'relative_path_validator' function within pulpcore (specifically in pulpcore/app/serializers/fields.py). The validator only checks if a path is absolute (starting with '/') but fails to sanitize directory traversal sequences like '../'. An authenticated administrator can upload a crafted artifact with a 'relative_path' containing these sequences. During a 'FilesystemExport' operation, the application uses 'os.path.join' with the malicious path, causing the file to be written outside the designated export directory. This allows arbitrary file writes with the permissions of the 'pulp' service user, potentially leading to full system compromise. Patches are available for Red Hat products via RHSA-2026:42078, RHSA-2026:42079, and RHSA-2026:42082.
Affected products
- Pulp Project pulpcore Through 3.110.0.dev
- Red Hat Red Hat Ansible Automation Platform 2.5 RHEL 8, RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.6 RHEL 9, RHEL 10
- Red Hat Red Hat Satellite 6.16 RHEL 8, RHEL 9
- Red Hat Red Hat Update Infrastructure 4 RHEL 8
- Red Hat Red Hat Update Infrastructure 5 All versions
Timeline
- 2026-06-19: disclosed: Reported to Red Hat Bugzilla
- 2026-07-20: advisory: NVD and Red Hat advisories published
- 2026-07-20: patched: Red Hat released security updates (RHSA)