Vulnerability-Lookup

CVE-2026-25705 (GCVE-0-2026-25705)

Vulnerability from cvelistv5 – Published: 2026-05-13 08:00 – Updated: 2026-05-14 03:55

Title

Rancher Extensions have arbitrary file access via path traversal

Summary

A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to: * Overwrite Rancher binaries or configuration to inject code. * Write to /var/lib/rancher/ to tamper with cluster state. * If hostPath volumes are mounted, write to the host node filesystem. * Use this issue to chain with other attack vectors.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 00:00 UTC

CWE

CWE-35 - Path traversal: '.../...//'

Assigner

suse CNA under the mitre root

CNA scorecard B 80/100 over 118 records in the last 180 days details

References

2 references

URL	Tags
https://bugzilla.suse.com/show_bug.cgi?id=CVE-202…
https://github.com/rancher/rancher/security/advis…

Impacted products

1 product

Vendor	Product	Version	CPE status
SUSE	rancher	Affected: 2.14.0 , < 2.14.1 (semver) Affected: 2.13.0 , < 2.13.5 (semver) Affected: 2.12.0 , < 2.12.9 (semver) Affected: 2.10.11 , < 2.11.13 (semver)	guessed

Credits

https://github.com/KoreaSecurity

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T03:55:59.252Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/rancher/rancher",
          "product": "rancher",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.14.1",
              "status": "affected",
              "version": "2.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.13.5",
              "status": "affected",
              "version": "2.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.12.9",
              "status": "affected",
              "version": "2.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.11.13",
              "status": "affected",
              "version": "2.10.11",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "https://github.com/KoreaSecurity"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability has been identified in [Rancher\u0027s Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:\u003cdiv\u003e\u003cul\u003e\u003cli\u003eOverwrite Rancher binaries or configuration to inject code.\u003c/li\u003e\n\u003cli\u003eWrite to \u003ccode\u003e/var/lib/rancher/\u003c/code\u003e to tamper with cluster state.\u003c/li\u003e\n\u003cli\u003eIf \u003ccode\u003ehostPath\u003c/code\u003e volumes are mounted, write to the host node filesystem.\u003c/li\u003e\n\u003cli\u003eUse this issue to chain with other attack vectors.\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
            }
          ],
          "value": "A vulnerability has been identified in [Rancher\u0027s Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35 Path traversal: \u0027.../...//\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T08:01:27.283Z",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25705"
        },
        {
          "url": "https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Rancher Extensions have arbitrary file access via path traversal",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2026-25705",
    "datePublished": "2026-05-13T08:00:46.097Z",
    "dateReserved": "2026-02-05T15:37:24.184Z",
    "dateUpdated": "2026-05-14T03:55:59.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-25705",
      "date": "2026-11-01",
      "epss": "0.00369",
      "percentile": "0.30746"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageName": "github.com/rancher/rancher",
                "product": "rancher",
                "vendor": "SUSE",
                "versions": [
                  {
                    "lessThan": "2.14.1",
                    "status": "affected",
                    "version": "2.14.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.13.5",
                    "status": "affected",
                    "version": "2.13.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.12.9",
                    "status": "affected",
                    "version": "2.12.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.11.13",
                    "status": "affected",
                    "version": "2.10.11",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "meissner@suse.de"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability has been identified in [Rancher\u0027s Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad ha sido identificada en las [extensiones de Rancher](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) donde se puede inyectar c\u00f3digo malicioso en Rancher a trav\u00e9s de un salto de ruta en el campo \u201ccompressedEndpoint\u201d dentro de un despliegue de \u201cUIPlugin\u201d. Una extensi\u00f3n de UI maliciosa podr\u00eda abusar de ello para:\n  *  Sobrescribir binarios o la configuraci\u00f3n de Rancher para inyectar c\u00f3digo.\n  *  Escribir en /var/lib/rancher/ para manipular el estado del cl\u00faster.\n  *  Si los vol\u00famenes hostPath est\u00e1n montados, escribir en el sistema de archivos del nodo host.\n  *  Usar este problema para encadenar con otros vectores de ataque."
          }
        ],
        "id": "CVE-2026-25705",
        "lastModified": "2026-10-26T14:10:00.130",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.7,
              "impactScore": 6.0,
              "source": "meissner@suse.de",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-25705",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-13T08:16:16.083",
        "references": [
          {
            "source": "meissner@suse.de",
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25705"
          },
          {
            "source": "meissner@suse.de",
            "url": "https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35"
          }
        ],
        "sourceIdentifier": "meissner@suse.de",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-35"
              }
            ],
            "source": "meissner@suse.de",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-14T08:21:04+00:00",
      "cve": "CVE-2026-25705",
      "id": "CVE-2026-25705",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Rancher Extensions have arbitrary file access via path traversal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25705.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-25705",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-13T10:43:35.110390Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-13T10:48:07.203Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageName": "github.com/rancher/rancher",
              "product": "rancher",
              "vendor": "SUSE",
              "versions": [
                {
                  "lessThan": "2.14.1",
                  "status": "affected",
                  "version": "2.14.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "2.13.5",
                  "status": "affected",
                  "version": "2.13.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "2.12.9",
                  "status": "affected",
                  "version": "2.12.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "2.11.13",
                  "status": "affected",
                  "version": "2.10.11",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "https://github.com/KoreaSecurity"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A vulnerability has been identified in [Rancher\u0027s Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:\u003cdiv\u003e\u003cul\u003e\u003cli\u003eOverwrite Rancher binaries or configuration to inject code.\u003c/li\u003e\n\u003cli\u003eWrite to \u003ccode\u003e/var/lib/rancher/\u003c/code\u003e to tamper with cluster state.\u003c/li\u003e\n\u003cli\u003eIf \u003ccode\u003ehostPath\u003c/code\u003e volumes are mounted, write to the host node filesystem.\u003c/li\u003e\n\u003cli\u003eUse this issue to chain with other attack vectors.\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
                }
              ],
              "value": "A vulnerability has been identified in [Rancher\u0027s Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-35",
                  "description": "CWE-35 Path traversal: \u0027.../...//\u0027",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-13T08:01:27.283Z",
            "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
            "shortName": "suse"
          },
          "references": [
            {
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25705"
            },
            {
              "url": "https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Rancher Extensions have arbitrary file access via path traversal",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "assignerShortName": "suse",
        "cveId": "CVE-2026-25705",
        "datePublished": "2026-05-13T08:00:46.097Z",
        "dateReserved": "2026-02-05T15:37:24.184Z",
        "dateUpdated": "2026-05-14T03:55:59.252Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-25705

Vulnerability from fkie_nvd - Published: 2026-05-13 08:16 - Updated: 2026-10-26 14:10

Severity

8.4 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	meissner@suse.de	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25705
	meissner@suse.de	https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/rancher/rancher",
          "product": "rancher",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.14.1",
              "status": "affected",
              "version": "2.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.13.5",
              "status": "affected",
              "version": "2.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.12.9",
              "status": "affected",
              "version": "2.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.11.13",
              "status": "affected",
              "version": "2.10.11",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "meissner@suse.de"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in [Rancher\u0027s Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.\n\n  *  Write to /var/lib/rancher/ to tamper with cluster state.\n\n  *  If hostPath volumes are mounted, write to the host node filesystem.\n\n  *  Use this issue to chain with other attack vectors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad ha sido identificada en las [extensiones de Rancher](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) donde se puede inyectar c\u00f3digo malicioso en Rancher a trav\u00e9s de un salto de ruta en el campo \u201ccompressedEndpoint\u201d dentro de un despliegue de \u201cUIPlugin\u201d. Una extensi\u00f3n de UI maliciosa podr\u00eda abusar de ello para:\n  *  Sobrescribir binarios o la configuraci\u00f3n de Rancher para inyectar c\u00f3digo.\n  *  Escribir en /var/lib/rancher/ para manipular el estado del cl\u00faster.\n  *  Si los vol\u00famenes hostPath est\u00e1n montados, escribir en el sistema de archivos del nodo host.\n  *  Usar este problema para encadenar con otros vectores de ataque."
    }
  ],
  "id": "CVE-2026-25705",
  "lastModified": "2026-10-26T14:10:00.130",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 6.0,
        "source": "meissner@suse.de",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25705",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-13T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-13T08:16:16.083",
  "references": [
    {
      "source": "meissner@suse.de",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25705"
    },
    {
      "source": "meissner@suse.de",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35"
    }
  ],
  "sourceIdentifier": "meissner@suse.de",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-35"
        }
      ],
      "source": "meissner@suse.de",
      "type": "Secondary"
    }
  ]
}

GHSA-5V3H-X4WF-5C35

Vulnerability from github – Published: 2026-05-07 01:23 – Updated: 2026-05-14 20:31

Summary

Rancher Extensions have arbitrary file access via path traversal

Details

Impact

A vulnerability has been identified in Rancher's Extensions where malicious code can be injected in Rancher through a path traversal in the compressedEndpoint field inside a UIPlugin deployment. A malicious UI extension could abuse that to:

Overwrite Rancher binaries or configuration to inject code.
Write to /var/lib/rancher/ to tamper with cluster state.
If hostPath volumes are mounted, write to the host node filesystem.
Use this issue to chain with other attack vectors.

By default only the administrator can deploy UI extensions, unless permissions are granted to other users. It's always recommended to only install extensions that come from sources trusted by the user.

Please consult the associated MITRE CAPEC-126 - Technique - Path Traversal for further information about this category of attack.

Patches

This vulnerability is addressed by ensuring that:

The file defined by the UI Plugin CR's compressedEndpoint has to be created inside the cache directory and cannot contain ../. If that is not possible, the installation will fail and the file won't be created.
The icons referenced by Cluster Repos' index.yaml file always resolves to a file inside the repository directory.

Patched versions of Rancher include releases v2.14.1, v2.13.5, v2.12.9, v2.11.13.

Workarounds

There is no workaround. The user must be careful about which UI Plugins they install.

Resources

If there are any questions or comments about this advisory:

Reach out to the SUSE Rancher Security team for security related inquiries.
Open an issue in the Rancher repository.
Verify with the support matrix and product support lifecycle.

Severity

8.4 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.14.0"
            },
            {
              "fixed": "2.14.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.13.0"
            },
            {
              "fixed": "2.13.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.12.0"
            },
            {
              "fixed": "2.12.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.10.11"
            },
            {
              "fixed": "2.11.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25705"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-35"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T01:23:59Z",
    "nvd_published_at": "2026-05-13T08:16:16Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA vulnerability has been identified in [Rancher\u0027s Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:\n\n- Overwrite Rancher binaries or configuration to inject code.\n- Write to `/var/lib/rancher/` to tamper with cluster state.\n- If `hostPath` volumes are mounted, write to the host node filesystem.\n- Use this issue to chain with other attack vectors.\n\nBy default only the administrator can deploy UI extensions, unless permissions are granted to other users. It\u0027s always recommended to only install extensions that come from sources trusted by the user.\n\nPlease consult the associated  [MITRE CAPEC-126 - Technique - Path Traversal](https://capec.mitre.org/data/definitions/126.html) for further information about this category of attack.\n\n### Patches\n\nThis vulnerability is addressed by ensuring that:\n\n- The file defined by the UI Plugin CR\u0027s `compressedEndpoint` has to be created inside the cache directory and cannot contain `../`. If that is not possible, the installation will fail and the file won\u0027t be created. \n- The icons referenced by Cluster Repos\u0027 `index.yaml` file always resolves to a file inside the repository directory.\n\nPatched versions of Rancher include releases v2.14.1, v2.13.5, v2.12.9, v2.11.13.\n\n### Workarounds\n\nThere is no workaround. The user must be careful about which UI Plugins they install.\n\n### Resources\n\nIf there are any questions or comments about this advisory:\n\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with the [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "id": "GHSA-5v3h-x4wf-5c35",
  "modified": "2026-05-14T20:31:20Z",
  "published": "2026-05-07T01:23:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25705"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25705"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/rancher"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rancher Extensions have arbitrary file access via path traversal"
}

WID-SEC-W-2026-1347

Vulnerability from csaf_certbund - Published: 2026-05-03 22:00 - Updated: 2026-05-14 22:00

Summary

Rancher: Schwachstelle ermöglicht Codeausführung und Manipulation von Dateien

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2026-25705.

CVE-2026-25705

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-25705 (GCVE-0-2026-25705)

FKIE_CVE-2026-25705

GHSA-5V3H-X4WF-5C35

Impact

Patches

Workarounds

Resources

WID-SEC-W-2026-1347

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour