External risk intelligence

pulpcore Path Traversal Leads to Arbitrary File Write

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-12701

The vulnerability requires authenticated administrative access to the platform to trigger the specific FilesystemExport operation. While the service may be reachable over a network, administrative interfaces are typically restricted to internal networks or management VPNs rather than being directly exposed to the public internet in common deployment patterns.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A path traversal vulnerability has been identified in pulpcore's content path validation, allowing an authenticated administrator to write to arbitrary file locations. This could potentially lead to service compromise or further system exploitation by overwriting critical files or configuration settings.

Path traversal flaw allows writing anywhere.
Attackers could gain control of services.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to pulpcore could exploit this vulnerability by crafting a special file path. This path would contain directory traversal sequences, like `../`, allowing the attacker to write uploaded content to arbitrary locations on the system instead of the intended export directory. Successful exploitation could lead to the compromise of the pulp service or further exploitation of the underlying system.

Requires authenticated administrator access.
Crafts a malicious relative path during export.
Allows arbitrary file write, risking compromise.

Live Threat

Current exploitation, exposure, and threat context

An authenticated administrator could exploit a path traversal vulnerability to write arbitrary files to any location the pulp service user can access. This could occur when performing FilesystemExport operations with crafted relative paths containing directory traversal sequences. The impact ranges from service compromise to further system exploitation.

System files and configuration data.
Crafted relative paths during export.
Service compromise or system exploitation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts pulpcore and is likely the responsibility of the platform or infrastructure team managing the pulp service. The first step is to identify all instances of pulpcore, confirm their reachability and criticality, and then identify the accountable owner for remediation.

Platform teams should own this issue.
Verify pulpcore instances and their exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the pulpcore software used for?

pulpcore is the core engine behind Pulp, a platform commonly used by system administrators to manage and distribute software packages and container images. It provides the infrastructure to host repositories, handle artifacts, and manage the lifecycle of content in enterprise environments.

How does CWE-22 relate to CVE-2026-12701?

CVE-2026-12701 is classified as CWE-22, which is the weakness known as Improper Limitation of a Pathname to a Restricted Directory, or Path Traversal. In this case, the software fails to correctly strip or block sequences like '../' from file paths. This oversight allows a user to escape the intended storage directory and write or overwrite files elsewhere on the system's filesystem.

Can any user trigger this vulnerability?

No. This vulnerability is not triggered by casual browsing or unauthenticated network requests. It specifically requires an attacker to already possess administrative-level access to the platform. Furthermore, the flaw is only triggered during the FilesystemExport operation; performing other types of platform tasks does not activate this specific path traversal defect.

Is my instance of pulpcore at high risk?

Halo Surface Signal indicates this risk is 'Unlikely' for many environments because successful exploitation depends on having authenticated administrative credentials. While the service might be reachable over a network, most administrative interfaces are restricted to internal management segments or VPNs, limiting the pool of potential attackers who could reach the vulnerable function.

What should I do if I manage pulpcore?

Your first step is to locate all active deployments of pulpcore within your environment to understand your footprint. Once identified, confirm which network segments have access to the administrative interface. Contact your platform or infrastructure team to ensure they are aware of the vulnerability and have prioritized the necessary software updates to address the underlying validation flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.