https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:06:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-339565 EUVD-2026-339565 https://cve.radiocsirt.org/vuln/euvd-2026-339565 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12701 <p>A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with &#34;/&#34; but fails to block directory traversal sequences such as &#34;../&#34; anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., &#34;looking/normal/../../../../etc/shadow&#34;) that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.</p> <p>A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with &#34;/&#34; but fails to block directory traversal sequences such as &#34;../&#34; anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., &#34;looking/normal/../../../../etc/shadow&#34;) that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12701 https://cve.radiocsirt.org/vuln/ghsa-j5cg-p988-g42q <p>A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with &#34;/&#34; but fails to block directory traversal sequences such as &#34;../&#34; anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., &#34;looking/normal/../../../../etc/shadow&#34;) that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.</p> <p>A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with &#34;/&#34; but fails to block directory traversal sequences such as &#34;../&#34; anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., &#34;looking/normal/../../../../etc/shadow&#34;) that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.</p> https://cve.radiocsirt.org/vuln/ghsa-j5cg-p988-g42q https://cve.radiocsirt.org/vuln/rhsa-2026:42078 <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration…</p> <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:42078