CVE-2026-84232
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
Risk Assessment
The risk includes execution of malicious scripts in users' browsers, potentially leading to session theft, account takeover, or other attacks in the application context.
Recommendation
Update pulpcore to a patched version that enforces appropriate Content-Disposition headers and content types, and restrict file upload permissions to trusted users only.
Other vulnerabilities in pulpcore
Original NVD description (English source)
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.