CVE-2026-90959

Description

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry.

Overview

State: PUBLISHED
Assigner (CNA): redhat
CVSS severity: HIGH
CVSS score: 8.1 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Effective score: 8.1 / 10 HIGH source: CNA overview
CWE(s): CWE-22
Reserved: 2026-09-14
Published: 2026-09-24 14:49 UTC
Last updated: 2026-09-24 14:49 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90959.json
Linked Threat: CVE-2026-90959 — Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85920
Assigner: redhat
Published: Sep 24, 2026, 2:49:10 PM
Updated: Sep 24, 2026, 2:49:10 PM
EUVD base score (CVSS 3.1): 8.1 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EUVD-reported EPSS: 0.0000
Aliases: GHSA-mfxv-9hc5-3jv3

ENISA description: A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry.

EUVD references (2)

Affected products (20)

Vendor	Product	Versions	Platforms
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Satellite 6	—	—
Red Hat	Red Hat Satellite 6	—	—
Red Hat	Red Hat Satellite 6	—	—
Red Hat	Red Hat Satellite 6	—	—
Red Hat	Red Hat Satellite 6	—	—
Red Hat	Red Hat Update Infrastructure 4 for Cloud Providers	—	—
Red Hat	Red Hat Update Infrastructure 4 for Cloud Providers	—	—
Red Hat	Red Hat Update Infrastructure 4 for Cloud Providers	—	—
Red Hat	Red Hat Update Infrastructure 5	—	—
Red Hat	Red Hat Update Infrastructure 5	—	—
Red Hat	Red Hat Update Infrastructure 5	—	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://access.redhat.com/security/cve/CVE-2026-90959 vdb-entryx_refsource_REDHAT
RHBZ#2533037 issue-trackingx_refsource_REDHAT

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Online-Fix - Discord

web:discord.com

Check out the Online- Fix community on Discord - hang out with 108471 other members and enjoy free voice and text chat.

2026-09-25 10:09 UTC
Car Values | Fix it up Wiki | Fandom

web:fix-it-up.fandom.com

1 Merquis G Wafer 2 Porx JT3 RF 3 Mata FX7 4 Missah Groundline F34 5 Kart 6 Porx JT2 RF 7 Missah Groundline F32 8 Lambemos Golhoes 9 Lambemos Iris 10 DOGO Desafio 11 Lararry R40 12 Missah JTF 13 Toyoda Supwa A90 14 Holde NisX 15 Chule Curgette C7 16 McLumber 520 17 Sucato Empresa 18 Vemca K3 G 19 Holde S2k 20 Toyoda TR2 21 Toyoda Supwa 22 Ruity Shadow 23 Four Mustank 70s 24 Mata 787F 25 ...

2026-09-25 10:09 UTC
Fix it up Wiki | Fandom

web:fix-it-up.fandom.com

Fix It Up is a Roblox car repair simulator game developed by .workspace. Players buy or find broken cars, repair damaged parts, customize them, and sell them for profit.

2026-09-25 10:09 UTC
Why Brewers Pulled Jacob Misiorowski After Pitching 3 Innings

web:heavy.com

Milwaukee had Jacob Misiorowski pitching in primetime against the Orioles, but he didn't go too deep into the game.

2026-09-25 10:09 UTC
SkyBlock Patch Notes

web:hypixel.net

All SkyBlock Patch Notes can be found here! You can click the Watch button in this section to be alerted when new Patch Notes are released!

2026-09-25 10:09 UTC
Reaper Patches

web:reaperpatches.com

American Made Patches

2026-09-25 10:09 UTC
Buprenorphine Patch: Package Insert / Prescribing Info

web:www.drugs.com

Buprenorphine Patch package insert / prescribing information for healthcare professionals. Includes: indications, dosage, adverse reactions and pharmacology.

2026-09-25 10:09 UTC
DirectStorageFix - GTA5-Mods.com

web:www.gta5-mods.com

About DirectStorageFix prevents GTAV Enhanced from opening a handle for every single file in the game directory when DirectStorage is enabled. Instead, only .rpf and .cache files are allowed. If you use scripts that write to existing log files, config files, or other data files in the game directory, this fix will restore their ability to write to those files. Additionally, script developers ...

2026-09-25 10:09 UTC
We all make mistakes, Ed. Please fix this one. - Instagram

web:www.instagram.com

292K likes, 4,324 comments - mrzachwoods on September 15, 2026 : "We all make mistakes, Ed. Please fix this one.".

2026-09-25 10:09 UTC
Jennifer Eckhart, former Fox Business news producer, dies at 36

web:www.tcpalm.com

Former Fox Business producer and Florida native Jennifer Eckhart died by suicide at 36 years old, Martin County officials confirm.

2026-09-25 10:09 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-90959.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-24/hub-rhel8",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-25/hub-rhel8",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-26/hub-rhel9",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-27/hub-rhel9",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "pulpcore-selinux",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python3.11-pulpcore",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python3.12-pulpcore",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python3x-pulpcore",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python-pulpcore",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "pulpcore-obsolete-packages",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "pulpcore-selinux",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "affected",
          "packageName": "python3.12-pulpcore",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulpcore",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rubygem-pulpcore_client",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhui:4::el8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "pulpcore-selinux",
          "product": "Red Hat Update Infrastructure 4 for Cloud Providers",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhui:4::el8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python-pulpcore",
          "product": "Red Hat Update Infrastructure 4 for Cloud Providers",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhui:4::el8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python-pulpcore-client",
          "product": "Red Hat Update Infrastructure 4 for Cloud Providers",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python-pulpcore-client",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhui5/rhua-tp-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Yonghwa Lee (Xint by Theori) for reporting this issue."
        }
      ],
      "datePublic": "2026-09-24T14:26:36.623Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:49:10.024Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-90959"
        },
        {
          "name": "RHBZ#2533037",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533037"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-12T03:35:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-24T14:26:36.623Z",
          "value": "Made public."
        }
      ],
      "title": "Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft",
      "workarounds": [
        {
          "lang": "en",
          "value": "No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-90959",
    "datePublished": "2026-09-24T14:49:10.024Z",
    "dateReserved": "2026-09-14T13:07:08.553Z",
    "dateUpdated": "2026-09-24T14:49:10.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}