Description
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
Published: 2026-09-01
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

If immediate update is not possible, administrators can add security headers to the Apache reverse proxy configuration for the /pulp/content/ path. On Satellite, add the following to the Apache configuration (e.g., via a custom .conf file in /etc/httpd/conf.d/ or via a Puppet override): ``` <Location /pulp/content> Header set Content-Disposition "attachment" Header set X-Content-Type-Options "nosniff" Header set Content-Security-Policy "default-src 'none'; sandbox" </Location> ``` This forces all content downloads rather than inline rendering, and blocks script execution even if Content-Disposition is somehow bypassed. After applying, restart Apache: ```systemctl restart httpd``` Alternatively, restrict file upload permissions in Satellite to only trusted users who require content management capabilities.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
Title Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content
First Time appeared Redhat
Redhat ansible Automation Platform
Redhat rhui
Redhat satellite
Weaknesses CWE-79
CPEs cpe:/a:redhat:ansible_automation_platform:2
cpe:/a:redhat:rhui:4::el8
cpe:/a:redhat:rhui:5::el9
cpe:/a:redhat:satellite:6
Vendors & Products Redhat
Redhat ansible Automation Platform
Redhat rhui
Redhat satellite
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Redhat Ansible Automation Platform Rhui Satellite
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-01T17:43:42.487Z

Reserved: 2026-09-01T12:16:44.850Z

Link: CVE-2026-84232

cve-icon Vulnrichment

Updated: 2026-09-01T17:43:39.341Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-01T16:17:36.360

Modified: 2026-09-01T21:03:04.987

Link: CVE-2026-84232

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-01T00:00:00Z

Links: CVE-2026-84232 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T03:15:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')