CVE-2026-12701criticalCWE-22

CVE-2026-12701: critical vulnerability in Red Hat Ansible Automation Platform 2

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

Published · Updated

Follow this CVE+ Monitor Red Hat Ansible Automation Platform+ Monitor Red Hat Satellite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9epss 1.2%
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Affected products
Red Hat · Red Hat Ansible Automation Platform 2Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat · Red Hat Ansible Automation Platform 2.6Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat · Red Hat Ansible Automation Platform 2.7Red Hat · Red Hat Satellite 6.16 for RHEL 8Red Hat · Red Hat Satellite 6.16 for RHEL 9Red Hat · Red Hat Satellite 6.17 for RHEL 9Red Hat · Red Hat Satellite 6.18 for RHEL 9Red Hat · Red Hat Satellite 6.19 for RHEL 9Red Hat · Red Hat Update Infrastructure 4 for Cloud ProvidersRed Hat · Red Hat Update Infrastructure 5
Related CVEs — Red Hat Ansible Automation Platform 2

In the same product, most dangerous first.

CVE-2026-71364HIGHAwx: project archive extraction allows path traversal file writesEPSS 1.7%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2023-50782HIGHPython-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659EPSS 1.1%CVE-2026-44189HIGHAnsible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filenameEPSS 1.0%CVE-2026-12398HIGHGalaxy_ng: shell injection in legacy role import via unsanitized git ref namesEPSS 0.9%