Cross-Site Scripting Vulnerability in Pulp File-Serving Application
CVE-2026-84232

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Red Hat Satellite 6
Red Hat Update Infrastructure 4 For Cloud Providers
Red Hat Update Infrastructure 5
Vendor
CVE Published:
1 September 2026

What is CVE-2026-84232?

A security flaw in Pulp's content serving application allows authenticated users or those with upload permissions to upload maliciously crafted HTML or SVG files containing JavaScript. These files, served with their original content type and lacking a Content-Disposition: attachment header, can execute scripts in the browsers of users accessing the file URL, leading to stored cross-site scripting (XSS) vulnerabilities in the context of the host application.

References

https://access.redhat.com/security/cve/CVE-2026-84232
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2526807
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.