CVE-2026-12701: Pulpcore Path Traversal Vulnerability

CVE-2026-12701 Overview

CVE-2026-12701 is a path traversal vulnerability [CWE-22] in pulpcore, the core component of the Pulp content management platform. The flaw resides in the relative_path_validator function, which only rejects paths beginning with / but fails to filter embedded directory traversal sequences such as ../. An authenticated administrator can supply a crafted relative_path during a FilesystemExport operation to escape the intended export directory. Because the exported file content is also attacker-controlled through uploaded artifacts, the flaw enables arbitrary file write to any location writable by the Pulp service account.

Critical Impact

Arbitrary file write as the Pulp service user can lead to service compromise, code execution, and lateral movement across systems consuming Pulp-managed content.

Affected Products

• pulpcore (Pulp Project core component)
• Red Hat Satellite deployments bundling pulpcore
• Red Hat product streams referenced in advisories RHSA-2026:42078 through RHSA-2026:42240

Discovery Timeline

• 2026-07-20 - CVE-2026-12701 published to the National Vulnerability Database
• 2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-12701

Vulnerability Analysis

The vulnerability lives in pulpcore's relative_path_validator, a function meant to constrain user-supplied paths used during filesystem exports. The validator enforces a single rule: reject strings that start with /. It performs no normalization of the path and no rejection of parent-directory tokens embedded later in the string. An authenticated administrator invoking a FilesystemExport can therefore submit a value such as looking/normal/../../../../etc/shadow. The validator accepts the value because it does not begin with /, and the export routine then resolves the traversal at the filesystem layer, writing outside the export root.

The impact is amplified because the file body written to the traversed path is a user-uploaded artifact. Attackers control both the destination and the contents. Writable targets under the Pulp service account include cron directories, systemd unit files, Python site-packages, and web server document roots, each of which offers a path to code execution or privilege escalation.

Root Cause

The root cause is insufficient input validation. The validator applies a prefix check instead of canonicalizing the path with a function such as os.path.realpath and confirming the result stays inside the export directory. Blocklist-only validation fails against traversal sequences that appear mid-path.

Attack Vector

Exploitation requires authenticated administrator access to the pulpcore API and network reachability to the Pulp instance. The attacker uploads an artifact whose payload matches the file they want to plant, then triggers a FilesystemExport with a relative_path containing ../ sequences pointing to the target location. No user interaction is required, and the attack succeeds against default configurations that grant the Pulp service user write access to sensitive paths.

No public exploit code has been published. Refer to the Red Hat CVE-2026-12701 Information and Red Hat Bug #2490703 Details for vendor technical detail.

Detection Methods for CVE-2026-12701

Indicators of Compromise

• Pulp API requests containing ../ or URL-encoded %2e%2e%2f sequences inside relative_path parameters submitted to FilesystemExport endpoints.
• Files owned by the Pulp service user appearing outside configured export directories, particularly under /etc, /var/spool/cron, /usr/lib/systemd, or web roots.
• Unexpected modifications to shell startup files, authorized_keys, or service unit files timestamped shortly after export API activity.

Detection Strategies

• Parse pulpcore API access logs for FilesystemExport calls and flag relative_path values containing .., backslashes, or encoded traversal tokens.
• Enable filesystem auditing (auditd or equivalent) on directories writable by the Pulp service user and alert on writes originating from pulpcore worker processes to paths outside the sanctioned export root.
• Correlate artifact upload events with subsequent export operations to identify sequences consistent with the exploit pattern.

Monitoring Recommendations

• Ship pulpcore application logs and host audit logs into a centralized analytics platform and retain them for at least 90 days.
• Baseline the set of paths targeted by legitimate FilesystemExport operations and alert on deviations.
• Monitor administrator account activity for anomalous export volumes, off-hours use, or requests from unfamiliar source addresses.

How to Mitigate CVE-2026-12701

Immediate Actions Required

• Apply the pulpcore updates referenced in the Red Hat advisories listed below to every affected system without delay.
• Rotate credentials for all pulpcore administrator accounts, on the assumption that any prior compromise could persist through planted files.
• Audit the filesystem for artifacts written outside the configured export directory by the Pulp service user since the vulnerability window.

Patch Information

Red Hat has released fixed builds through multiple advisories, including RHSA-2026:42078, RHSA-2026:42079, RHSA-2026:42082, RHSA-2026:42132, RHSA-2026:42142, RHSA-2026:42150, RHSA-2026:42151, and RHSA-2026:42240. Fixed pulpcore versions add canonicalization and boundary checks to relative_path_validator.

Workarounds

• Restrict administrator role assignments and require multi-factor authentication for accounts that can invoke FilesystemExport.
• Run the pulpcore service under a dedicated, unprivileged user with a filesystem policy that limits write access to a narrowly scoped export directory.
• Place the pulpcore export directory on a filesystem mount separated from system binaries and configuration paths, using mount options that limit execution where feasible.
• Add a reverse proxy or WAF rule to block API requests whose relative_path field contains .., encoded traversal tokens, or absolute paths until patching is complete.