CVE-2026-103870: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Satellite 6

This vulnerability in Red Hat Satellite 6's pulp-rpm arises from improper limitation of pathname to a restricted directory during the publishing of a distribution tree. Specifically, addon and variant IDs extracted from .treeinfo files are used as directory names without sufficient validation, allowing a user with sync or upload capabilities to cause the publish task to create directories outside the designated task work area. This enables writing repository metadata and packages outside the intended directory as the Pulp worker user. The flaw does not replace existing files or directories, does not disclose data, and does not interrupt service availability.

An attacker with sync or upload permissions can write repository metadata and packages outside the intended directory structure, potentially leading to unauthorized file creation or modification. However, the vulnerability does not result in data disclosure or service disruption. The impact is limited to integrity concerns without confidentiality or availability compromise.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-103870 for current remediation guidance. Until a fix is applied, restrict sync and upload permissions to trusted users only to minimize risk.