CVE-2026-12701 in pulpcore
Summary
by MITRE • 07/20/2026
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability represents a critical path traversal flaw in the pulpcore application that stems from inadequate input validation within the relative_path_validator function. The security weakness manifests when the system fails to properly sanitize user-supplied paths during filesystem export operations, allowing maliciously crafted paths to bypass the initial validation check that only prevents leading forward slashes. The vulnerability specifically targets the filesystem export functionality where authenticated administrators can manipulate path sequences containing directory traversal elements such as "../" that can appear anywhere within the path string rather than just at the beginning.
The technical implementation of this flaw enables attackers to exploit the incomplete validation mechanism by embedding traversal sequences within seemingly normal file paths, creating malicious paths like "looking/normal/../../../../etc/shadow" that escape the intended export directory boundaries. This type of vulnerability is classified as a CWE-23 path traversal weakness where insufficient input sanitization allows unauthorized access to files outside of designated directories. The vulnerability operates at the intersection of improper input validation and insecure file handling, creating a pathway for arbitrary file write operations that can be leveraged by authenticated users with administrative privileges.
The operational impact of this vulnerability extends beyond simple unauthorized file access, as it provides attackers with the ability to write content to any location within the filesystem that is writable by the Pulp service user account. This creates a potential compromise vector where malicious actors could manipulate critical system files, inject malicious code into the application environment, or establish persistence mechanisms within the target system. The attack surface becomes particularly dangerous because Pulp administrators typically possess elevated privileges and the service usually runs with sufficient permissions to modify system-critical locations.
From an adversary perspective, this vulnerability aligns with ATT&CK technique T1059.007 for command and script injection while also mapping to T1078 credential access patterns where legitimate administrative accounts are leveraged for privilege escalation. The security implications include potential data exfiltration through file read operations, service disruption via file corruption, and complete system compromise when attackers can write malicious files to critical locations within the operating system. Organizations should immediately implement mitigations including strict path validation that blocks all traversal sequences regardless of their position within the path string, enforcement of proper access controls for the Pulp service user, and implementation of additional monitoring for suspicious filesystem operations.
The recommended remediation strategy involves comprehensive input validation that explicitly rejects any path containing directory traversal sequences using regular expressions or dedicated path sanitization functions. Organizations should also implement mandatory file system sandboxing that restricts all export operations to predefined directories with no parent directory access capabilities. Additional protective measures include logging and monitoring for unusual filesystem access patterns, implementing least privilege principles for the Pulp service account, and conducting regular security assessments of the application's file handling mechanisms. The vulnerability demonstrates the importance of defense in depth approaches where multiple layers of validation and access control work together to prevent exploitation of single point failures within application logic.