{"id":"EUVD-2026-29915","revision":"e11bedf685404548ad2b8bbe3626c599","records":[{"revision":"e11bedf685404548ad2b8bbe3626c599","observedAt":"2026-10-28T02:10:22.704+00:00","statement":{"source":"euvd","id":"EUVD-2026-29915","aliases":["CVE-2026-25705","GHSA-5v3h-x4wf-5c35"],"title":"A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEnd…","description":"A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","score":8.4,"severity":null}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25705","https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29915","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 13, 2026, 8:00:46 AM","dateUpdated":"May 14, 2026, 3:55:59 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-29915","identifiers":["EUVD-2026-29915","CVE-2026-25705","GHSA-5v3h-x4wf-5c35"]},"retained":false,"historicalAffected":[]}],"coverage":[]}