{"id":"CVE-2026-25705","revision":"fa8aa7adc806472595d00506b374edbf","records":[{"revision":"fa8aa7adc806472595d00506b374edbf","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-25705","aliases":[],"title":"Rancher Extensions have arbitrary file access via path traversal","description":"A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors.","state":0,"publishedAt":"2026-05-13T08:00:46.097+00:00","modifiedAt":"2026-05-14T03:55:59.252+00:00","affected":[{"ecosystem":"Vendor product","name":"github.com/rancher/rancher","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"SUSE\",\n                    \"product\": \"rancher\",\n                    \"packageName\": \"github.com/rancher/rancher\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.14.0\",\n                            \"lessThan\": \"2.14.1\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.13.0\",\n                            \"lessThan\": \"2.13.5\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.12.0\",\n                            \"lessThan\": \"2.12.9\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.10.11\",\n                            \"lessThan\": \"2.11.13\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25705","https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-25705","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-25705","identifiers":["CVE-2026-25705"]},"retained":false,"historicalAffected":[]}],"coverage":[]}