---
id: CVE-2026-90959
title: A path traversal vulnerability was found in pulpcore
summary: >-
  A path traversal vulnerability was found in pulpcore. The content upload API
  accepts a 'file_url' parameter that allows users with file repository
  privileges to specify a local file URL for Pulp to download and store. A URL
  scheme valida…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-22
vendor: Red Hat
product: ansible-automation-platform-24/hub-rhel8
affected:
  - ansible-automation-platform-24/hub-rhel8 (all versions)
  - ansible-automation-platform-25/hub-rhel8 (all versions)
  - ansible-automation-platform-26/hub-rhel9 (all versions)
  - ansible-automation-platform-27/hub-rhel9 (all versions)
  - pulpcore-selinux
  - python3.11-pulpcore
  - python3.12-pulpcore
  - python3x-pulpcore
  - python-pulpcore
  - pulpcore-obsolete-packages
  - pulpcore-selinux
  - python3.12-pulpcore (all versions)
  - python-pulpcore (all versions)
  - rubygem-pulpcore_client
  - pulpcore-selinux
  - python-pulpcore
  - python-pulpcore-client
  - python-pulpcore-client
  - rhui5/rhua-rhel9 (all versions)
  - rhui5/rhua-tp-rhel9
published: '2026-09-24'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T18:17:32.367'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90959'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-90959'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2533037'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90959.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-90959'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90959'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-25T17:47:33.555341Z'
ingestedAt: '2026-09-24T15:45:56.649Z'
epss: 0.00316
epssPercentile: 0.21853
---

## Overview

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, Red Hat Update Infrastructure 5 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, Red Hat Update Infrastructure 5 · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90959.json)