{"id":"CVE-2026-84232","title":"Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content","summary":"A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-D…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Red Hat","product":"ansible-automation-platform-24/hub-rhel8","affected":["ansible-automation-platform-24/hub-rhel8","ansible-automation-platform-25/hub-rhel8","ansible-automation-platform-26/hub-rhel9","ansible-automation-platform-27/hub-rhel9","python3.11-pulpcore","python3.12-pulpcore","python3x-pulpcore","python-pulpcore","python3.12-pulpcore (all versions)","python-pulpcore (all versions)","python-pulpcore","rhui5/rhua-rhel9","rhui5/rhua-tp-rhel9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-01T17:43:35.765110Z"},"published":"2026-09-01","updated":"2026-09-17","sourceUpdated":"2026-09-17T07:22:08.585Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-84232","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-84232"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526807","label":"RHBZ#2526807"}],"tags":["cve.org"],"epss":0.00176,"epssPercentile":0.07437,"ingestedAt":"2026-09-17T08:14:19.084Z","slug":"CVE-2026-84232","body":"## Overview\n\nA flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.\n\n## Affected\n\n- `ansible-automation-platform-24/hub-rhel8`\n- `ansible-automation-platform-25/hub-rhel8`\n- `ansible-automation-platform-26/hub-rhel9`\n- `ansible-automation-platform-27/hub-rhel9`\n- `python3.11-pulpcore`\n- `python3.12-pulpcore`\n- `python3x-pulpcore`\n- `python-pulpcore`\n- `python3.12-pulpcore (all versions)`\n- `python-pulpcore (all versions)`\n- `python-pulpcore`\n- `rhui5/rhua-rhel9`\n- `rhui5/rhua-tp-rhel9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nIf immediate update is not possible, administrators can add security headers to the Apache reverse proxy configuration for the /pulp/content/ path. On Satellite, add the following to the Apache configuration (e.g., via a custom .conf file in /etc/httpd/conf.d/ or via a Puppet override):\n\n```\n  <Location /pulp/content>\n    Header set Content-Disposition \"attachment\"\n    Header set X-Content-Type-Options \"nosniff\"\n    Header set Content-Security-Policy \"default-src 'none'; sandbox\"\n  </Location>\n```\nThis forces all content downloads rather than inline rendering, and blocks script execution even if Content-Disposition is somehow bypassed.\n\nAfter applying, restart Apache: ```systemctl restart httpd```\nAlternatively, restrict file upload permissions in Satellite to only trusted users who require content management capabilities.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}