https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:36:40.055137+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-19574 cnvd-2018-19574 2026-10-03T06:36:40.076302+00:00 cnvd-2018-19574 https://cve.radiocsirt.org/vuln/euvd-2026-64910 EUVD-2026-64910 2026-10-03T06:36:40.076359+00:00 EUVD-2026-64910 https://cve.radiocsirt.org/vuln/fkie_cve-2018-10917 fkie_cve-2018-10917 2026-10-03T06:36:40.076380+00:00

pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.

 https://cve.radiocsirt.org/vuln/ghsa-574p-6fw4-4hw8 Withdrawn: GHSA-574p-6fw4-4hw8 — Withdrawn Advisory: Pulp Improper Path Parsing 2026-10-03T06:36:40.076424+00:00

Withdrawn by the publisher.

Affected: PyPI: pulpcore

## Withdrawn Advisory This advisory has been withdrawn because the package [pulpcore](https://pypi.org/project/pulpcore/) deals with pulp 3 only. This advisory concerns [pulp 2](https://github.com/pulp/pulp), which is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems).

## Original Description pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.

 https://cve.radiocsirt.org/vuln/gsd-2018-10917 gsd-2018-10917 2026-10-03T06:36:40.076466+00:00 gsd-2018-10917 https://cve.radiocsirt.org/vuln/rhea-2019:1283 RHEA-2019:1283 — Red Hat Enhancement Advisory: RHUI 3.1 bug fix and enhancement update 2026-10-03T06:36:40.076484+00:00

pulp: Improper path parsing leads to overwriting of iso repositories