Path Traversal in Pulpcore Content Upload API (CVE-2026-90959)

A path traversal vulnerability exists in the pulpcore content upload API (CVE-2026-90959). The vulnerability stems from an insufficient validation of the 'file_url' parameter used by users with file repository privileges. While the application attempts to restrict file system access by rejecting URLs starting with 'file://', it fails to account for Python URL parser behavior that recognizes 'file:' without double slashes. By supplying a specially crafted URL, an authenticated user can bypass this check and utilize relative path traversal sequences (e.g., ../../) to read any file accessible to the Pulp server process. In environments utilizing Pulp Container, this flaw allows attackers to exfiltrate the container registry token signing private key, enabling the forgery of bearer tokens and providing unauthorized access to private container repositories.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to read arbitrary files on the host system running the Pulp server process. In the context of Pulp Container, this leads to the compromise of the token signing private key, resulting in total loss of confidentiality and integrity for all private container repositories managed by the instance.

Recommendation

Prioritize patching all affected Pulpcore and Pulp Container instances to the version containing the fix for CVE-2026-90959. Monitor web server access logs for anomalous requests to the content upload API containing traversal sequences such as '..%2f' or '..%5c' within the 'file_url' parameter.