This vulnerability (CVE-2026-25705) involves a path traversal issue (CWE-35) in the compressedEndpoint field of UIPlugin deployments within SUSE Rancher Extensions. An attacker controlling a malicious UI extension can exploit this flaw to write arbitrary files, potentially overwriting Rancher binaries or configuration files, modifying cluster state under /var/lib/rancher/, or writing to the host node filesystem if hostPath volumes are mounted. The vulnerability has a CVSS 3.1 base score of 8.4, indicating high severity with network attack vector, low attack complexity, required privileges at high level, and user interaction required. The vulnerability is published but no official fix or patch is currently available from the vendor. The affected Rancher versions include 2.10.11, 2.12.0, 2.13.0, and 2.14.0.

Exploitation can lead to complete compromise of Rancher server integrity by overwriting binaries or configuration files, tampering with cluster state data, and potentially compromising the host node filesystem if hostPath volumes are mounted. This can result in full control over the Rancher environment and potentially the underlying infrastructure. The vulnerability requires high privileges and user interaction, but once exploited, it can cause high confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict deployment of untrusted UI extensions and avoid mounting hostPath volumes in UIPlugin deployments to reduce risk. Monitor vendor communications for updates on patches or official mitigations.