Vulnary
← back to the feed
Critical· 9

CVE-2026-12701

A critical path‑traversal flaw in pulpcore lets an authenticated administrator write files outside the intended export directory. By including sequences like "../../" in a relative path, the attacker can overwrite any file the Pulp service can write, potentially compromising the service or the host.

publishedJul 20, 2026
last modifiedJul 22, 2026
sourcesNVD
severity · cvss
9
critical · how bad it is
exploitation · epss
<1%
52th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 3, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

pulpcore, any version that includes the vulnerable relative_path_validator function.

02

Real-world impact

An attacker with administrator privileges can create or overwrite arbitrary files on the system, which may lead to full service compromise or further exploitation of the host.

03

Why this severity

The CVSS score of 9 reflects that the vulnerability is exploitable over the network, requires low effort, needs high privileges, and can lead to loss of confidentiality, integrity, and availability.

04

What to do about it

no official fix yet

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in sources

05

Timeline

  1. Jul 20, 2026 · 13d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 22, 2026 · 11d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredHigh
User interactionNone needed
ScopeChanged
Confidentiality impactLow
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →