{"id":"EUVD-2026-29915","enisaUuid":"117c13b4-5e03-3281-b6c5-917ef5f40d56","description":"A vulnerability has been identified in [Rancher\u0027s Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors.","datePublished":"May 13, 2026, 8:00:46 AM","dateUpdated":"May 14, 2026, 3:55:59 AM","baseScore":8.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2026-25705\nhttps://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35\n","aliases":"CVE-2026-25705\nGHSA-5v3h-x4wf-5c35\n","assigner":"suse","epss":0.37,"enisaIdProduct":[{"id":"136d6d03-ed75-3769-b0e4-1c1868be1c73","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.10.11 \u003c2.11.13"},{"id":"79d7967f-b25f-3682-8335-490f3ebeecaf","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.12.0 \u003c2.12.9"},{"id":"99efdb7e-8e3a-33f9-8ffe-5bd7d21572b8","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.13.0 \u003c2.13.5"},{"id":"f6f9a5eb-d77a-3791-a02e-1a7a8412eeb6","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.14.0 \u003c2.14.1"}],"enisaIdVendor":[{"id":"6ec1aa30-e630-3853-a986-71adc3d26f6c","vendor":{"name":"SUSE"}}],"enisaIdVulnerability":[{"id":"39b25627-63a8-35f0-a01c-1a482dc37261","vulnerability":{"id":"GHSA-5v3h-x4wf-5c35","description":"Rancher Extensions have arbitrary file access via path traversal","datePublished":"May 7, 2026, 1:23:59 AM","dateUpdated":"May 14, 2026, 8:31:20 PM","baseScore":0.0,"references":"https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-25705\nhttps://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2026-25705\nhttps://github.com/rancher/rancher\n","enisa_id":"EUVD-2026-29915\n","aliases":"CVE-2026-25705\nGHSA-5v3h-x4wf-5c35\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"df410bcf-fa2b-39d4-965c-7c730227354e","vulnerability":{"id":"CVE-2026-25705","description":"A vulnerability has been identified in [Rancher\u0027s Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors.","datePublished":"May 13, 2026, 8:00:46 AM","dateUpdated":"May 14, 2026, 3:55:59 AM","status":"PUBLISHED","baseScore":8.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2026-25705\nhttps://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35\n","enisa_id":"EUVD-2026-29915\n","assigner":"suse","epss":0.37,"dataProcessed":"Oct 27, 2026, 7:13:18 AM","vulnerabilityProduct":[{"id":"19c15b90-1f5a-3ac6-819e-5f29ced81f8d","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.10.11 \u003c2.11.13"},{"id":"3598c368-38d2-3c98-a2c5-2db5706d4b38","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.14.0 \u003c2.14.1"},{"id":"6576999b-ff0a-3f5b-9937-727877be826a","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.13.0 \u003c2.13.5"},{"id":"88ec711f-876c-3efb-8489-a977e8bf79a8","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.12.0 \u003c2.12.9"}],"vulnerabilityVendor":[{"id":"b575cfed-e98a-3feb-bfb0-e32a31b380ae","vendor":{"name":"SUSE"}}]}}],"enisaIdAdvisory":[]}