https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 09:57:53 +0000 https://db.gcve.eu/vuln/cve-2026-103870 <p><strong>Affected:</strong> Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers, Red Hat Update Infrastructure 5</p> <p>A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree&#39;s repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service.</p> <p><strong>Affected:</strong> Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers, Red Hat Update Infrastructure 5</p> <p>A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree&#39;s repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service.</p> https://db.gcve.eu/vuln/cve-2026-103870