A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
There is no complete mitigation for this vulnerability. The following measures can reduce risk:
- If FilesystemExport was never configured on your deployment, you are not affected by this issue.
- If FilesystemExporters exist in the database, audit them for path traversal sequences ("../"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.
- Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.
- Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.
- Monitor filesystem changes outside of expected Pulp directories for signs of exploitation.