---
id: CVE-2026-84232
title: >-
  Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of
  uploaded html/svg content
summary: >-
  A flaw was found in pulpcore's content serving application. Files uploaded to
  Pulp file-type repositories are served with their original content type (e.g.,
  text/html for .html files, image/svg+xml for .svg files) and without a
  Content-D…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Red Hat
product: ansible-automation-platform-24/hub-rhel8
affected:
  - ansible-automation-platform-24/hub-rhel8
  - ansible-automation-platform-25/hub-rhel8
  - ansible-automation-platform-26/hub-rhel9
  - ansible-automation-platform-27/hub-rhel9
  - python3.11-pulpcore
  - python3.12-pulpcore
  - python3x-pulpcore
  - python-pulpcore
  - python3.12-pulpcore (all versions)
  - python-pulpcore (all versions)
  - python-pulpcore
  - rhui5/rhua-rhel9
  - rhui5/rhua-tp-rhel9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-01T17:43:35.765110Z'
published: '2026-09-01'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T07:22:08.585Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-84232'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-84232'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2526807'
    label: RHBZ#2526807
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.07455
ingestedAt: '2026-09-17T08:14:19.084Z'
---

## Overview

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.

## Affected

- `ansible-automation-platform-24/hub-rhel8`
- `ansible-automation-platform-25/hub-rhel8`
- `ansible-automation-platform-26/hub-rhel9`
- `ansible-automation-platform-27/hub-rhel9`
- `python3.11-pulpcore`
- `python3.12-pulpcore`
- `python3x-pulpcore`
- `python-pulpcore`
- `python3.12-pulpcore (all versions)`
- `python-pulpcore (all versions)`
- `python-pulpcore`
- `rhui5/rhua-rhel9`
- `rhui5/rhua-tp-rhel9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

If immediate update is not possible, administrators can add security headers to the Apache reverse proxy configuration for the /pulp/content/ path. On Satellite, add the following to the Apache configuration (e.g., via a custom .conf file in /etc/httpd/conf.d/ or via a Puppet override):

```
  <Location /pulp/content>
    Header set Content-Disposition "attachment"
    Header set X-Content-Type-Options "nosniff"
    Header set Content-Security-Policy "default-src 'none'; sandbox"
  </Location>
```
This forces all content downloads rather than inline rendering, and blocks script execution even if Content-Disposition is somehow bypassed.

After applying, restart Apache: ```systemctl restart httpd```
Alternatively, restrict file upload permissions in Satellite to only trusted users who require content management capabilities.