{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.11-pulpcore","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3x-pulpcore","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","product":"Red Hat Satellite 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","product":"Red Hat Satellite 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","product":"Red Hat Update Infrastructure 4 for Cloud Providers","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-84232","cwes":["CWE-79"],"description":"A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.","epss":{"date":"2026-11-05","percentile":0.14496,"score":0.00235},"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793927143848,"publishedAt":1788275939649,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-84232"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526807"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"If immediate update is not possible, administrators can add security headers to the Apache reverse proxy configuration for the /pulp/content/ path. On Satellite, add the following to the Apache configuration (e.g., via a custom .conf file in /etc/httpd/conf.d/ or via a Puppet override):\n\n```\n  <Location /pulp/content>\n    Header set Content-Disposition \"attachment\"\n    Header set X-Content-Type-Options \"nosniff\"\n    Header set Content-Security-Policy \"default-src 'none'; sandbox\"\n  </Location>\n```\nThis forces all content downloads rather than inline rendering, and blocks script execution even if Content-Disposition is somehow bypassed.\n\nAfter applying, restart Apache: ```systemctl restart httpd```\nAlternatively, restrict file upload permissions in Satellite to only trusted users who require content management capabilities."}],"revision":"be671b208544b70c15b11f35a0c272e221d15a891b234422064404676e668e04","sources":[{"modifiedAt":1793927143848,"name":"CNA: redhat","retrievedAt":1793930959015,"url":"https://www.cve.org/CVERecord?id=CVE-2026-84232"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793930961173,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84232"}],"ssvc":{"assessedAt":1788284615765,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content","updatedAt":1793930961173}