Bug 2544606 (CVE-2026-103870)

Summary: CVE-2026-103870 pulp-rpm: Distribution tree publish creates directories from .treeinfo ids
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, dranck, ehelms, ggainey, jpasqual, juwatts, lbrazdil, mdellweg, mhulan, mminar, nmoumoul, osousa, pcreech, rbiba, rchan, security-response-team, smallamp, sskracic, tmalecek, tpfromme
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-01 12:30:50 UTC 
Publish copies the addon id and variant id from .treeinfo into addon_id and variant_id with no path check (pulp_rpm/app/kickstart/treeinfo.py). RpmPublication.populate() then calls os.mkdir(name) with that string (pulp_rpm/app/tasks/publishing.py) and writes the synced metadata and packages under that name. os.mkdir does not create missing parents, and it fails when the path already exists, so an existing file is not replaced. A ".." component or an absolute id whose parent exists leaves the worker temporary directory. The same code runs for any repository version that contains a distribution tree. No extra setting selects it. Introduced with kickstart publishing in 8a8048e2, tag 3.0.0b5, and every stable release from 3.2.0.