CVE-2026-12701: Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Red Hat Ansible Automation Platform 2

  • all versionsunknown

• Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

  • 0:3.49.63-2.el8ap and laternot affected · rpm

• Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

  • 0:3.49.63-2.el9ap and laternot affected · rpm

• Red Hat Red Hat Ansible Automation Platform 2.6

  • 1783979593 and laternot affected · rpm

• Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

  • 0:3.49.63-2.el9ap and laternot affected · rpm

• Red Hat Red Hat Ansible Automation Platform 2.7

  • 1783919521 and laternot affected · rpm

• Red Hat Red Hat Satellite 6.16 for RHEL 8

  • 0:3.49.39-2.el8pc and laternot affected · rpm
  • 0:3.49.39-2.el8pc and laternot affected · rpm

• Red Hat Red Hat Satellite 6.16 for RHEL 9

  • 0:3.49.39-2.el9pc and laternot affected · rpm
  • 0:3.49.39-2.el9pc and laternot affected · rpm

• Red Hat Red Hat Satellite 6.17 for RHEL 9

  • 0:3.63.21-2.el9pc and laternot affected · rpm
  • 0:3.63.21-2.el9pc and laternot affected · rpm

• Red Hat Red Hat Satellite 6.18 for RHEL 9

  • 0:3.73.30-2.el9pc and laternot affected · rpm
  • 0:3.73.30-2.el9pc and laternot affected · rpm

• Red Hat Red Hat Satellite 6.19 for RHEL 9

  • 0:3.85.15-5.el9pc and laternot affected · rpm
  • 0:3.85.15-5.el9pc and laternot affected · rpm

• Red Hat Red Hat Update Infrastructure 4 for Cloud Providers

  • all versionsaffected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-11807Eda-server: websocket missing authorization allows credential theft via activation_id spoofing
  38Monitor
• CVE-2025-49521Event-driven-ansible: template injection via git branch and refspec in eda projects
  35Monitor
• CVE-2025-49520Event-driven-ansible: authenticated argument injection in git url in eda project creation
  35Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-52902Jun 9, 2026 · Awxkit: path traversal via yaml !include directive
  18Monitor
• ← EarlierCVE-2026-12382Jul 15, 2026 · Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing
  32Monitor
• Later →CVE-2026-12383Jul 27, 2026 · Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.