This vulnerability (CVE-2026-25705) in SUSE Rancher arises from a path traversal issue (CWE-35) in the compressedEndpoint field of UIPlugin deployments within Rancher's Extensions. An attacker deploying a malicious UI extension can exploit this to perform unauthorized file writes, including overwriting Rancher binaries or configuration files, modifying cluster state data in /var/lib/rancher/, and writing to the host node filesystem if hostPath volumes are mounted. The vulnerability has a CVSS 3.1 score of 8.4 (high severity) with network attack vector, low attack complexity, requiring high privileges and user interaction, and impacts confidentiality, integrity, and availability. Affected versions include Rancher 2.10.11 through 2.14.0. No vendor advisory or patch information is currently provided, and no known exploits have been reported.

Successful exploitation can lead to full compromise of the Rancher environment by allowing code injection, overwriting critical binaries or configuration files, tampering with cluster state, and potentially affecting the host node filesystem. This impacts confidentiality, integrity, and availability of the affected systems. The vulnerability requires high privileges and user interaction to exploit, but once exploited, it can have severe consequences on Rancher deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict deployment of untrusted UI extensions and limit privileges to reduce risk. Monitor Rancher environments for suspicious UIPlugin deployments and avoid mounting hostPath volumes if possible to limit filesystem exposure.