Path Traversal Vulnerability in Rancher's Extensions Platform

CVE-2026-25705

What is CVE-2026-25705?

A vulnerability exists in Rancher's Extensions platform that allows attackers to exploit a path traversal issue in the compressedEndpoint field during a UIPlugin deployment. This flaw enables malicious extensions to inject harmful code, overwrite critical Rancher binaries or configurations, and alter the cluster state by writing to /var/lib/rancher/. Additionally, if hostPath volumes are mounted, attackers can manipulate the host node filesystem, potentially chaining this vulnerability with other security weaknesses to escalate their attack.

References