This vulnerability in Red Hat Ansible Automation Platform 2 involves improper limitation of a pathname to a restricted directory in the pulpcore component. The relative_path_validator function only checks that content paths do not start with a slash but does not prevent directory traversal sequences embedded anywhere in the path. An authenticated administrator can craft a relative path containing traversal sequences to escape the intended export directory during FilesystemExport operations. Because the file content is user-controlled, this allows arbitrary file writes to any location writable by the Pulp service user, which could lead to service compromise or further exploitation.

An authenticated administrator can exploit this vulnerability to write arbitrary files outside the intended directory, potentially overwriting critical system or application files. This can lead to service compromise or enable further system exploitation. The CVSS score of 9.0 (critical) reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-12701 for current remediation guidance. Until a fix is available, restrict administrator access and monitor for suspicious activity related to FilesystemExport operations. Do not assume the vulnerability is mitigated without official confirmation.