ROS-20261023-73-0133

The vulnerability in python-pulpcore is related to the lack of protection for the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:87004)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87004 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Manage...

CVE-2026-90959

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

CVE-2026-90959 Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

pulp-ansible (>=0.22.0, <=0.23.1), pulp-container (>=2.21.0, <=2.22.13) +6 more potentially affected by CVE-2026-90959 via pulpcore (3.69.2)

pulpcore PYPI version 3.69.2 is affected by a known vulnerability. The following packages have a transitive dependency on pulpcore and may be impacted: - pulp-ansible =0.22.0, =2.21.0, =3.3.0, =0.6.0, =0.8.1, =2.4.0, =3.12.0, =3.25.6, =3.27.14 Source cves: CVE-2026-90959 Source advisory:...

pulp-ansible (>=0.21.0, <=0.21.19), pulp-container (>=2.17.0, <=2.20.14) +6 more potentially affected by CVE-2026-90959 via pulpcore (>=3.53.1, <=3.54.1)

pulpcore PYPI version =3.53.1, =0.21.0, =2.17.0, =3.1.0, =0.4.0, =0.7.0, =2.2.0, =3.11.0, =3.24.0, =3.27.0 Source cves: CVE-2026-90959 Source advisory: MEND:CVE-2026-90959...

galaxy-ng (>=4.2.0a3, <=4.9.2), pulp-2to3-migration (>=0.0.1rc1, <=0.17.0) +12 more potentially affected by CVE-2026-90959 via pulpcore (>=3.0.1, <=3.44.1)

pulpcore PYPI version =3.0.1, =4.2.0a3, =0.0.1rc1, =0.2.0b10, =0.1.0rc4, =1.0.0rc1, =0.1.0b5, =2.0.0b4, =0.1.0rc1, =0.1.0, =0.3.0, =0.1.0a1, =2.0.0a1, =3.0.0b9, =3.0.0, =3.23.6 Source cves: CVE-2026-90959 Source advisory: MEND:CVE-2026-90959...

pulp-ansible (>=0.24.0, <=0.27.1), pulp-container (>=2.23.0, <=2.25.1) +9 more potentially affected by CVE-2026-90959 via pulpcore (3.84.0)

pulpcore PYPI version 3.84.0 is affected by a known vulnerability. The following packages have a transitive dependency on pulpcore and may be impacted: - pulp-ansible =0.24.0, =2.23.0, =3.5.1, =0.6.2, =0.8.3, =0.1.0, =2.4.6, =3.13.0, =3.28.0, =0.0.0.dev0, =0.2.0 Source cves: CVE-2026-90959 Source...

pulp-ansible (>=0.28.0, <=0.28.10), pulp-container (>=2.26.0, <=2.26.19) +9 more potentially affected by CVE-2026-90959 via pulpcore (3.95.3)

pulpcore PYPI version 3.95.3 is affected by a known vulnerability. The following packages have a transitive dependency on pulpcore and may be impacted: - pulp-ansible =0.28.0, =2.26.0, =3.7.0, =0.7.2, =2.5.0, =3.18.0, =3.32.0, =3.33.1 - pulp-smart-proxy 0.3.0 Source cves: CVE-2026-90959 Source...

pulp-ansible (>=0.29.0, <=0.29.12), pulp-container (>=2.27.0, <=2.28.0) +11 more potentially affected by CVE-2026-90959 via pulpcore (>=3.109.1, <=3.117.2)

pulpcore PYPI version =3.109.1, =0.29.0, =2.27.0, =3.8.1, =0.12.0, =0.5.0, =3.23.0, =3.34.0, =0.1.0, =0.2.1 Source cves: CVE-2026-90959 Source advisory: MEND:CVE-2026-90959...

CVE-2026-90959

A path traversal vulnerability exists in pulpcore within the content upload API's file_url parameter. The root cause is a validation mismatch: the system rejects URLs starting with file://, but Python's URL parser accepts the file: scheme without double slashes. This allows an authenticated user ...

EUVD-2026-85920

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

CVE-2026-90959

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

CVE-2026-90959 Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

CVE-2026-90959

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

PT-2026-97849

Name of the Vulnerable Software and Affected Versions pulpcore affected versions not specified Description A path traversal issue exists in the content upload API via the file url parameter. The system employs a validation check that rejects URLs starting with 'file://', but because Python's URL...

CVE-2026-90959: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

CVE-2026-84232

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...