---
id: CVE-2026-12701
title: >-
  Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in
  filesystemexport
summary: >-
  A path traversal vulnerability was found in pulpcore. The
  relative_path_validator function only verifies that content paths do not begin
  with "/" but fails to block directory traversal sequences such as "../"
  anywhere in the path. An aut…
severity: critical
cvss: 9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: Red Hat
product: python3.12-pulpcore
affected:
  - python3.12-pulpcore (all versions)
  - python3.12-pulpcore (all versions)
  - python3.12-pulpcore (all versions)
  - python-pulpcore (all versions)
  - python-pulpcore (all versions)
  - python-pulpcore (all versions)
  - python-pulpcore (all versions)
  - python-pulpcore (all versions)
  - python-pulpcore (all versions)
  - python3.12-pulpcore (all versions)
  - python3.12-pulpcore (all versions)
  - python3.12-pulpcore (all versions)
  - python3.12-pulpcore (all versions)
  - ansible-automation-platform-26/hub-rhel9 (all versions)
  - ansible-automation-platform-27/hub-rhel9 (all versions)
  - python-pulpcore
  - python-pulpcore (all versions)
  - python-pulpcore-client (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-22T18:13:39.913416Z'
published: '2026-07-20'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T20:14:40.924Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-12701'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:42078'
    label: 'RHSA-2026:42078'
  - url: 'https://access.redhat.com/errata/RHSA-2026:42079'
    label: 'RHSA-2026:42079'
  - url: 'https://access.redhat.com/errata/RHSA-2026:42082'
    label: 'RHSA-2026:42082'
  - url: 'https://access.redhat.com/errata/RHSA-2026:42132'
    label: 'RHSA-2026:42132'
  - url: 'https://access.redhat.com/errata/RHSA-2026:42142'
    label: 'RHSA-2026:42142'
  - url: 'https://access.redhat.com/errata/RHSA-2026:42150'
    label: 'RHSA-2026:42150'
  - url: 'https://access.redhat.com/errata/RHSA-2026:42151'
    label: 'RHSA-2026:42151'
  - url: 'https://access.redhat.com/errata/RHSA-2026:42240'
    label: 'RHSA-2026:42240'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-12701'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2490703'
    label: RHBZ#2490703
tags:
  - cve.org
epss: 0.01194
epssPercentile: 0.67426
ingestedAt: '2026-10-15T00:02:07.327Z'
---

## Overview

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

## Affected

- `python3.12-pulpcore (all versions)`
- `python3.12-pulpcore (all versions)`
- `python3.12-pulpcore (all versions)`
- `python-pulpcore (all versions)`
- `python-pulpcore (all versions)`
- `python-pulpcore (all versions)`
- `python-pulpcore (all versions)`
- `python-pulpcore (all versions)`
- `python-pulpcore (all versions)`
- `python3.12-pulpcore (all versions)`
- `python3.12-pulpcore (all versions)`
- `python3.12-pulpcore (all versions)`
- `python3.12-pulpcore (all versions)`
- `ansible-automation-platform-26/hub-rhel9 (all versions)`
- `ansible-automation-platform-27/hub-rhel9 (all versions)`
- `python-pulpcore`
- `python-pulpcore (all versions)`
- `python-pulpcore-client (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

There is no complete mitigation for this vulnerability. The following measures can reduce risk:

1. If FilesystemExport was never configured on your deployment, you are not affected by this issue.
2. If FilesystemExporters exist in the database, audit them for path traversal sequences ("../"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.
3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.
4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.
5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation.