Threats tagged 'ghsa-mfxv-9hc5-3jv3'

A path traversal vulnerability (CVE-2026-90959) exists in pulpcore's content upload API, where the 'file_url' parameter improperly validates the URL scheme. This allows authenticated users with file repository privileges to read arbitrary files accessible to the Pulp server process. In environments using Pulp Container, exploitation can lead to theft of the container registry token signing private key, enabling unauthorized access to private container repositories.