CVE-2026-90959 — Pulpcore: arbitrary file read through a file:// scheme allowlist bypass in the file_url upload parameter

A path traversal vulnerability was found in pulpcore. An authenticated low-privilege user with repository permissions can use a specially crafted URL to read files accessible to the Pulp server process.