Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

Description

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.

Timeline

Scores

EPSS (exploitation in 30 days)

0.24% · top 85% of all CVEs (11 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Affected products

• Red Hat · Red Hat Ansible Automation Platform 2

  All versions: unaffected

• Red Hat · Red Hat Ansible Automation Platform 2

  All versions: unaffected

• Red Hat · Red Hat Ansible Automation Platform 2

  All versions: unaffected

• Red Hat · Red Hat Ansible Automation Platform 2

  All versions: unaffected

• Red Hat · Red Hat Ansible Automation Platform 2

  All versions: unaffected

• Red Hat · Red Hat Ansible Automation Platform 2

  All versions: unaffected

• Red Hat · Red Hat Ansible Automation Platform 2

  All versions: unaffected

• Red Hat · Red Hat Ansible Automation Platform 2

  All versions: unaffected

• Red Hat · Red Hat Satellite 6

  All versions: affected

• Red Hat · Red Hat Satellite 6

  All versions: affected

• Red Hat · Red Hat Update Infrastructure 4 for Cloud Providers

  All versions: unaffected

• Red Hat · Red Hat Update Infrastructure 5

  All versions: unaffected

• Red Hat · Red Hat Update Infrastructure 5

  All versions: unaffected

What to do

Workaround: If immediate update is not possible, administrators can add security headers to the Apache reverse proxy configuration for the /pulp/content/ path. On Satellite, add the following to the Apache configuration (e.g., via a custom .conf file in /etc/httpd/conf.d/ or via a Puppet override): ``` <Location /pulp/content> Header set Content-Disposition "attachment" Header set X-Content-Type-Options "nosniff" Header set Content-Security-Policy "default-src 'none'; sandbox" </Location> ``` This forces all content downloads rather than inline rendering, and blocks script execution even if Content-Disposition is somehow bypassed. After applying, restart Apache: ```systemctl restart httpd``` Alternatively, restrict file upload permissions in Satellite to only trusted users who require content management capabilities.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-69293 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-84232](https://cveledger.app/badge/CVE-2026-84232.svg)](https://cveledger.app/cve/CVE-2026-84232)

Record last updated 6 Nov 2026, 01:05 UTC.