relative_path_validator bypass via directory traversal in FilesystemExport
Summary
relative_path_validator bypass via directory traversal in FilesystemExport. Red Hat rates this important (CVSS 9). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:42079 with package python3.12-pulpcore-0:3.49.63-2.el9ap, python-pulpcore-0:3.49.39-2.el9pc, python3.12-pulpcore-0:3.85.15-5.el9pc, python-pulpcore-0:3.49.39-2.el8pc. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
What this means
In plain English
relative_path_validator bypass via directory traversal in FilesystemExport. Red Hat rates this important (CVSS 9). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:42079 with package python3.12-pulpcore-0:3.49.63-2.el9ap, python-pulpcore-0:3.49.39-2.el9pc, python3.12-pulpcore-0:3.85.15-5.el9pc, python-pulpcore-0:3.49.39-2.el8pc. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8. Path traversal can escape an intended file location and expose files or directories available to the affected process.
Recommended action
Primary action: update to a vendor-listed fixed release: python3.12-pulpcore-0:3.49.63-2.el9ap, python-pulpcore-0:3.49.39-2.el9pc, python3.12-pulpcore-0:3.85.15-5.el9pc, python-pulpcore-0:3.49.39-2.el8pc, python-pulpcore-0:3.63.21-2.el9pc, python3.12-pulpcore-0:3.73.30-2.el9pc, python3.12-pulpcore-0:3.49.63-2.el8ap, RHSA-2026:42079. Temporary workaround: The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path.
Rewritten locally from the scraped official advisory data above; no generative API is used. The vendor advisory is authoritative.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 15 hours ago·verify at source
- python3.12-pulpcore-0:3.49.63-2.el9ap
- python-pulpcore-0:3.49.39-2.el9pc
- python3.12-pulpcore-0:3.85.15-5.el9pc
- python-pulpcore-0:3.49.39-2.el8pc
- python-pulpcore-0:3.63.21-2.el9pc
- python3.12-pulpcore-0:3.73.30-2.el9pc
- python3.12-pulpcore-0:3.49.63-2.el8ap
- RHSA-2026:42079
Official advisory · high-confidence parse· fetched 15 hours ago·verify at source
Mitigation checklist
- The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path.
Official advisory · high-confidence parse· fetched 15 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.