CVE-2026-84232

Name of the Vulnerable Software and Affected Versions pulpcore (affected versions not specified)

Description A flaw in the content serving application allows authenticated users or attackers with upload permissions to perform stored cross-site scripting (XSS). When using local filesystem storage, files uploaded to Pulp file-type repositories are served with their original content type (such as text/html or image/svg+xml) and lack a Content-Disposition: attachment header. This allows a specially crafted HTML or SVG file containing JavaScript to execute in the browser of any user who accesses the file URL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.