Threats tagged 'ghsa-wx3c-cxf8-mpww'

CVE-2026-103870 is a vulnerability in pulp-rpm where publishing a distribution tree uses addon and variant IDs from .treeinfo as directory names. This allows a user with sync or upload permissions to cause the publish task to create new directories outside the intended work area and write repository metadata and packages there as the Pulp worker user. The flaw does not disclose data or cause service disruption.