Executive brief
Pulp is a content repository management system used to store and serve files. A flaw in its file serving application allows authenticated users to upload malicious HTML or SVG files that execute JavaScript in other users' browsers when they view the file, potentially compromising user accounts and data if those users have administrative privileges. The vulnerability is limited by security measures that prevent direct session token theft, but still enables attackers to impersonate victims and access sensitive information.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in pulpcore's content serving application (CWE-79). The root cause is that files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL. While the HttpOnly flag on session cookies prevents direct token theft, the attacker's script can read page content, make authenticated API requests on behalf of the victim, and access visible data within the victim's active session. The vulnerability requires authentication for initial exploitation and user interaction (visiting the malicious file link). Patches are available; mitigation via Apache headers (Content-Disposition, X-Content-Type-Options, Content-Security-Policy) is available immediately.
Affected products
- Pulp Project pulpcore <UNKNOWN>
Timeline
- 2026-09-01: disclosed