CVE-2026-12701

Name of the Vulnerable Software and Affected Versions pulpcore (affected versions not specified)

Description A path traversal issue exists where the relative path validator() function only checks if content paths start with a forward slash but does not block directory traversal sequences like ../. An authenticated administrator can use a relative path containing these sequences to escape the intended export directory during FilesystemExport operations. Since the file content is user-controlled via uploaded artifacts, this allows arbitrary file writes to any location accessible by the Pulp service user, which could lead to service compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.