CVE-2026-12701: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The vulnerability in pulpcore's relative_path_validator function allows directory traversal by failing to block sequences like "../" anywhere in the path, enabling an authenticated administrator to escape the intended export directory during FilesystemExport operations. Because the file content is user-controlled, this can lead to arbitrary file writes to any location writable by the Pulp service user, which may result in service compromise or further exploitation. Red Hat has released security advisories (RHSA-2026:42078 and RHSA-2026:42079) that include fixes for this vulnerability in Ansible Automation Platform 2.6 for RHEL 9 and 10, and related components.

An authenticated administrator can exploit this vulnerability to write arbitrary files outside the intended directory, potentially leading to service compromise or further system exploitation. The CVSS 3.1 base score is 9.0 (critical), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Red Hat has released official fixes for this vulnerability in Ansible Automation Platform 2.6 for RHEL 9 and 10 as detailed in advisories RHSA-2026:42078 and RHSA-2026:42079. Users should apply these updates promptly. For detailed update instructions, refer to the Ansible Automation Platform documentation and the Red Hat advisories. Patch status is confirmed as fixed in these later versions. No alternative mitigations are stated in the vendor advisory.