A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | unaffected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | unaffected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | unaffected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | unaffected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | unaffected | — |
| Red Hat | Red Hat Satellite 6 | unaffected | — |
| Red Hat | Red Hat Satellite 6 | unaffected | — |
| Red Hat | Red Hat Satellite 6 | affected | — |
| Red Hat | Red Hat Satellite 6 | affected | — |
| Red Hat | Red Hat Satellite 6 | unaffected | — |
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | unaffected | — |
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | unaffected | — |
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | unaffected | — |
| Red Hat | Red Hat Update Infrastructure 5 | unaffected | — |
| Red Hat | Red Hat Update Infrastructure 5 | affected | — |
| Red Hat | Red Hat Update Infrastructure 5 | unaffected | — |
No data.
No data.
No data.
Project Subscriptions
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
References
History
Thu, 24 Sep 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry. | |
| Title | Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft | |
| First Time appeared |
Redhat
Redhat ansible Automation Platform Redhat rhui Redhat satellite |
|
| Weaknesses | CWE-22 | |
| CPEs | cpe:/a:redhat:ansible_automation_platform:2 cpe:/a:redhat:rhui:4::el8 cpe:/a:redhat:rhui:5::el9 cpe:/a:redhat:satellite:6 |
|
| Vendors & Products |
Redhat
Redhat ansible Automation Platform Redhat rhui Redhat satellite |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-09-24T14:49:10.024Z
Reserved: 2026-09-14T13:07:08.553Z
Link: CVE-2026-90959
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-24T15:17:53.540
Modified: 2026-09-24T15:17:53.540
Link: CVE-2026-90959
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses