Critical [CVE-2026-12701] relative_path_validator bypass via directory traversal in FilesystemExport
This critical-severity Red Hat Linux advisory covers CVE-2026-12701 affecting Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path.
An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations.
Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
This vulnerability is rated as Important severity because an authenticated administrator can achieve arbitrary file write outside the intended export directory with fully attacker-controlled content. The FilesystemExport API is restricted to admin-level users (in Satellite, authenticated via SSL certificate; in standalone RBAC deployments, admin role only).
The Pulp process runs as the "pulp" system user (not root), and file permission bits cannot be controlled by the attacker.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
- python3.12-pulpcore-0:3.49.63-2.el8ap
- python3.12-pulpcore-0:3.49.63-2.el9ap
- python-pulpcore-0:3.49.39-2.el8pc
- python-pulpcore-0:3.49.39-2.el9pc
- python-pulpcore-0:3.63.21-2.el9pc
- python3.12-pulpcore-0:3.73.30-2.el9pc
- python3.12-pulpcore-0:3.85.15-5.el9pc
- ansible-automation-platform-26/hub-rhel9:1783979593
- ansible-automation-platform-27/hub-rhel9:1783919521
- RHSA-2026:42078
- RHSA-2026:42079
- RHSA-2026:42082
- RHSA-2026:42150
- RHSA-2026:42151
- RHSA-2026:42240
- RHSA-2026:42132
- RHSA-2026:42142
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Mitigation checklist
- There is no complete mitigation for this vulnerability. The following measures can reduce risk: 1. If FilesystemExport was never configured on your deployment, you are not affected by this issue. 2. If FilesystemExporters exist in the database, audit them for path traversal sequences ("../"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths. 3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges. 4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to. 5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.