CVE-2026-12701 is a path traversal vulnerability in the pulpcore component of Red Hat Ansible Automation Platform 2.6. The relative_path_validator function fails to block directory traversal sequences such as "../" within content paths, allowing an authenticated administrator to craft paths that escape the intended export directory during FilesystemExport operations. Because the file content is user-controlled, this enables arbitrary file writes to any location writable by the pulp service user, potentially leading to service compromise or further exploitation. The FilesystemExport API is restricted to admin-level users, and the pulp process runs as a non-root user with write access to service-critical paths. Attack vectors include overwriting cron.d entries or Pulp configuration files. Red Hat Satellite and Ansible Automation Hub ship pulpcore and are affected. The vendor advisory provides detailed mitigation steps and a security update.

An authenticated administrator can write arbitrary files outside the intended export directory, potentially overwriting critical system or service files writable by the pulp user. This can lead to service compromise, unauthorized code execution, confidentiality breaches by reading sensitive files, and denial of service through corruption or deletion of important data. The vulnerability impacts integrity, confidentiality, and availability of the affected system. However, exploitation requires admin-level privileges and authentication.

A security update is available from Red Hat for Ansible Automation Platform 2.6 and should be applied. Before updating, ensure all previously released errata are applied. If FilesystemExport was never configured, the system is not affected. Existing FilesystemExporters should be audited for path traversal sequences and cleaned manually if found. Restrict admin-level access to trusted operators only. Ensure SELinux is in enforcing mode to limit pulp user's write access. Monitor filesystem changes outside expected directories for signs of exploitation.