CVE-2026-84232Medium· 5.4▾ SunlitA flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-D…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
ansible-automation-platform-24/hub-rhel8ansible-automation-platform-25/hub-rhel8ansible-automation-platform-26/hub-rhel9ansible-automation-platform-27/hub-rhel9python3.11-pulpcorepython3.12-pulpcorepython3x-pulpcorepython-pulpcorepython3.12-pulpcore (all versions)python-pulpcore (all versions)python-pulpcorerhui5/rhua-rhel9rhui5/rhua-tp-rhel9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
If immediate update is not possible, administrators can add security headers to the Apache reverse proxy configuration for the /pulp/content/ path. On Satellite, add the following to the Apache configuration (e.g., via a custom .conf file in /etc/httpd/conf.d/ or via a Puppet override):
<Location /pulp/content>
Header set Content-Disposition "attachment"
Header set X-Content-Type-Options "nosniff"
Header set Content-Security-Policy "default-src 'none'; sandbox"
</Location>
This forces all content downloads rather than inline rendering, and blocks script execution even if Content-Disposition is somehow bypassed.
After applying, restart Apache: systemctl restart httpd
Alternatively, restrict file upload permissions in Satellite to only trusted users who require content management capabilities.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93432Medium· 6.1A flaw was found in the Quarkus Qute template engine
CVE-2026-95619High· 7.7A flaw was found in libstdc++
CVE-2026-95508High· 7.4A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp
CVE-2026-95511High· 8.2A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial backend
CVE-2026-95503Medium· 6.8A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution
CVE-2026-93433Medium· 5.5A flaw was found in libstoragemgmt