{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/pulp/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9,"id":"CVE-2026-12701"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pulpcore"],"_cs_severities":["critical"],"_cs_tags":["path-traversal","vulnerability","linux","pulpcore"],"_cs_type":"advisory","_cs_vendors":["Pulp"],"content_html":"\u003cp\u003eA critical path traversal vulnerability, identified as CVE-2026-12701, has been discovered in Pulpcore, a component of the Pulp content management platform. The vulnerability resides in the \u003ccode\u003erelative_path_validator\u003c/code\u003e function, which, while designed to prevent content paths from starting with a slash (\u003ccode\u003e/\u003c/code\u003e), fails to adequately block directory traversal sequences such as \u003ccode\u003e../\u003c/code\u003e when embedded deeper within a path. This flaw allows an authenticated administrator to craft a malicious \u003ccode\u003erelative_path\u003c/code\u003e during \u003ccode\u003eFilesystemExport\u003c/code\u003e operations. By injecting traversal sequences (e.g., \u0026quot;looking/normal/../../../../etc/shadow\u0026quot;), an attacker can escape the intended export directory. Coupled with the ability to upload user-controlled file content (artifacts), this vulnerability facilitates arbitrary file write to any location on the system writable by the Pulp service user. Successful exploitation could lead to service compromise, privilege escalation, or further system exploitation, making it a severe risk for affected organizations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: An attacker obtains or already possesses authenticated administrator credentials for a Pulpcore instance.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePrepare Malicious Content\u003c/strong\u003e: The attacker prepares a malicious artifact (e.g., a web shell, a script, or a modified system configuration file like \u003ccode\u003e/etc/shadow\u003c/code\u003e) and uploads it to Pulpcore.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInitiate Export Operation\u003c/strong\u003e: The attacker initiates a \u003ccode\u003eFilesystemExport\u003c/code\u003e operation through the Pulpcore API or user interface.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCraft Traversal Path\u003c/strong\u003e: The attacker crafts a \u003ccode\u003erelative_path\u003c/code\u003e parameter for the export containing directory traversal sequences, such as \u003ccode\u003elooking/normal/../../../../etc/shadow\u003c/code\u003e, designed to escape the default export directory.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBypass Validation\u003c/strong\u003e: The vulnerable \u003ccode\u003erelative_path_validator\u003c/code\u003e function in Pulpcore processes the crafted path, but due to its flawed logic, it fails to identify and block the embedded \u003ccode\u003e../\u003c/code\u003e sequences.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArbitrary File Write\u003c/strong\u003e: Pulpcore proceeds to write the previously uploaded malicious artifact to the arbitrary location specified by the attacker's crafted \u003ccode\u003erelative_path\u003c/code\u003e, leveraging the privileges of the Pulp service user.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAchieve System Compromise\u003c/strong\u003e: The successful arbitrary file write allows the attacker to modify critical system files (like \u003ccode\u003e/etc/shadow\u003c/code\u003e for privilege escalation) or establish persistence mechanisms, leading to service compromise or further system exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful exploitation of CVE-2026-12701 results in arbitrary file write capabilities on the system running Pulpcore. This directly allows an attacker to overwrite or create files in sensitive locations, such as \u003ccode\u003e/etc/shadow\u003c/code\u003e for modifying user accounts or gaining root access, or injecting malicious scripts for persistence. The immediate impact is service compromise, but it can quickly escalate to full system takeover, unauthorized data access, or the deployment of additional malicious payloads. The vulnerability has a CVSS v3.1 base score of 9.0, indicating critical severity and a high potential for devastating impact on the confidentiality, integrity, and availability of affected systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-12701 by updating Pulpcore to the latest security-hardened version immediately to remediate the path traversal vulnerability.\u003c/li\u003e\n\u003cli\u003eReview server and application logs for the Pulp service user for any unusual file write activities, especially to sensitive system directories such as \u003ccode\u003e/etc\u003c/code\u003e, \u003ccode\u003e/var\u003c/code\u003e, or \u003ccode\u003e/usr/local\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs (e.g., Apache, Nginx) for the Pulpcore application for \u003ccode\u003eFilesystemExport\u003c/code\u003e operations or similar API calls that include suspicious \u003ccode\u003erelative_path\u003c/code\u003e parameters containing directory traversal sequences like \u003ccode\u003e../\u003c/code\u003e or their URL-encoded equivalents.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T15:17:58Z","date_published":"2026-07-20T15:17:58Z","id":"https://feed.craftedsignal.io/briefs/2026-07-path-traversal-pulpcore/","summary":"An authenticated administrator can exploit a path traversal vulnerability in the 'relative_path_validator' function within 'pulpcore'. During 'FilesystemExport' operations, specially crafted 'relative_path' values containing directory traversal sequences (e.g., \"../\") can bypass validation, leading to arbitrary file writes. This allows an attacker to write files to any location writable by the Pulp service user, such as '/etc/shadow', potentially leading to service compromise, privilege escalation, or further system exploitation.","title":"Path Traversal Vulnerability in Pulpcore (CVE-2026-12701)","url":"https://feed.craftedsignal.io/briefs/2026-07-path-traversal-pulpcore/"}],"language":"en","title":"CraftedSignal Threat Feed - Pulp","version":"https://jsonfeed.org/version/1.1"}