CVE-2026-84232 in Ansible Automation Platform
Summary
by MITRE • 09/01/2026
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within pulpcore's content serving mechanism represents a significant security flaw related to improper handling of uploaded media types and missing security headers when utilizing local filesystem storage backends. This issue specifically affects repositories configured with file-type storage, where the system serves user-uploaded files directly from the underlying operating system directory structure rather than through an intermediate proxy or application-layer filter that might enforce stricter content policies. The core technical deficiency lies in the fact that pulpcore preserves the original Content-Type header associated with the uploaded file without modification and fails to include a Content-Disposition: attachment header, which is critical for forcing browsers to treat downloaded files as attachments rather than executable resources. This combination of behaviors creates an environment where maliciously crafted content can be executed directly within the context of the web application's domain.
From a technical perspective, this flaw enables stored cross-site scripting attacks by allowing attackers to upload HTML or SVG files that contain embedded JavaScript payloads. When these files are served with their native MIME types such as text/html for HTML documents or image/svg+xml for Scalable Vector Graphics, modern browsers interpret the content according to its declared type rather than treating it as a static asset like an image or document. Consequently, if an authenticated user who possesses upload permissions crafts a file containing malicious script code and uploads it to a public-facing repository, that payload becomes persistent on the server side. Any subsequent visitor who accesses the direct URL of this uploaded file will have their browser execute the embedded JavaScript in the security context of the pulpcore application host. This results in the compromise of user sessions, potential data exfiltration, or further exploitation within the internal network depending on the privileges associated with the victim's session cookie and the scope of access granted by the web application framework.
The operational impact of this vulnerability is severe because it transforms a standard file storage feature into an attack vector for persistent code execution. Unlike reflected XSS which requires user interaction to trigger a one-time payload, stored XSS persists on the server until manually removed or overwritten. This means that every user who views the compromised content becomes a potential victim without needing to click any specific links beyond simply loading the page containing the malicious file reference if it were embedded elsewhere, though in this case direct URL access is sufficient. The attacker gains the ability to perform actions as the authenticated user, steal sensitive information such as authentication tokens or personal data displayed on the dashboard, and potentially use the compromised session to escalate privileges within the pulpcore administration interface if the victim holds administrative rights. This undermines the integrity of the content management system and poses a risk to any downstream systems that trust the authenticity of the hosted content.
In terms of industry classification standards, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically it falls under the subcategory of Stored XSS where malicious scripts are permanently stored on target servers. Furthermore from a tactical perspective within the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Control via Application Layer Protocol or more accurately T1189 Drive-by Client Side Scripting as it involves delivering code that executes automatically upon viewing. The lack of proper Content-Disposition headers also relates to CWE-693: Use of Multiple Inconsistent Control Schemes where the application fails to consistently apply security controls across different storage backends, allowing local filesystem storage to bypass protections that might be present in other configurations such as cloud object storage integrations which often have stricter default behaviors regarding content disposition.
Mitigation strategies must address both the immediate configuration issue and broader architectural defenses. The most direct remediation involves configuring pulpcore or its underlying web server proxy to enforce a Content-Disposition: attachment header for all served files regardless of their MIME type, thereby forcing browsers to download them rather than render them inline. Additionally administrators should implement strict allow-listing of allowed file extensions and content types in the upload validation layer to prevent HTML SVG and other executable script-containing formats from being stored as public-facing resources unless absolutely necessary. If such files must be hosted they should be served with a Content-Type that forces download or rendered through a sandboxed iframe with appropriate security headers like X-Content-Type-Options: nosniff to prevent MIME type sniffing by browsers. Implementing these controls ensures that even if malicious content is uploaded it cannot be executed in the context of the host application protecting both user sessions and system integrity from exploitation via this specific vector.