Skip to content
Heist/ feed
Medium

Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

Type: advisorySource: Official CVE List1 source record

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service.

Announced Group revision 1
Original source ↗

CVE-2026-103870

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103870

Red Hat Satellite 6

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Satellite 6

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Update Infrastructure 4 for Cloud Providers

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Update Infrastructure 4 for Cloud Providers

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/6/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:/a:redhat:satellite:6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6",
    "packageName": "python3.12-pulp-rpm",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:satellite:6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6",
    "packageName": "python-pulp-rpm",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:rhui:4::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Update Infrastructure 4 for Cloud Providers",
    "packageName": "python-pulp-rpm",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:rhui:4::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Update Infrastructure 4 for Cloud Providers",
    "packageName": "python-pulp-rpm-client",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:rhui:5::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Update Infrastructure 5",
    "packageName": "python-pulp-rpm-client",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:rhui:5::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Update Infrastructure 5",
    "packageName": "rhui5/rhua-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:rhui:5::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Update Infrastructure 5",
    "packageName": "rhui5/rhua-tp-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-103870

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#12201 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. CVE-2026-103870 · Revision 1Source updated