CVE-2026-12701

Advisory lineage Upstream: 0 Downstream: 6
Awaiting Analysis
Published: 20 Jul 2026, 14:18
Last modified:22 Jul 2026, 18:13

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9 CRITICAL
v3.1 (cve.org)
EPSS Score
1.19% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Jul 2026, 14:18
Published
Vulnerability first disclosed
22 Jul 2026, 18:13
Last Modified
Vulnerability information updated

Description

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

EPSS Trends

Current EPSS score: 1.19%• Percentile: 67%

Techniques & Countermeasures

  • CWE-22•Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (10)