pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

PT-2026-97849

Name of the Vulnerable Software and Affected Versions pulpcore affected versions not specified Description A path traversal issue exists in the content upload API via the file url parameter. The system employs a validation check that rejects URLs starting with 'file://', but because Python's URL...