CVE-2018-10870 — redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile

Matched remediation archetype

Path traversal, unsafe upload, and file handling

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Trace untrusted filenames, archive entries, URLs, and path segments into read, write, include, extraction, and upload operations.
• Identify filesystem roots, mount permissions, symbolic-link behavior, archive handling, and whether uploaded content is web-accessible or executable.
• Review canonicalization and containment checks across supported operating systems and storage backends.

Remediate safely

• Generate server-side storage identifiers and resolve paths beneath a fixed root using filesystem-aware containment checks.
• Reject absolute, parent-relative, alternate-separator, device, link, and archive entries that escape the intended root.
• Store uploads outside executable or served paths, validate type and size, and use private atomic temporary files.