CVE-2026-90959

Name of the Vulnerable Software and Affected Versions pulpcore (affected versions not specified)

Description A path traversal issue exists in the content upload API via the file url parameter. The system employs a validation check that rejects URLs starting with 'file://', but because Python's URL parser accepts the 'file:' scheme without double slashes, this check can be bypassed. An authenticated user with low-privilege repository permissions can use relative path traversal sequences to read any file accessible to the server process. In environments using Pulp Container, this can lead to the theft of the container registry token signing private key, enabling the forgery of bearer tokens and unauthorized access to all private container repositories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.