CVE-2026-44948

Published: Jun 30, 2026Modified: Oct 20, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: meissner@suse.de (Secondary)

Description

A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.

Affected (4)

Products: Suse: Rancher Fleet

Suse

1 product

Rancher Fleet

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Suse Rancher Fleet	0.12.0 ≤ version < 0.12.16
Suse Rancher Fleet	0.13.0 ≤ version < 0.13.12
Suse Rancher Fleet	0.14.0 ≤ version < 0.14.7
Suse Rancher Fleet	0.15.0 ≤ version < 0.15.3

Related CWEs

CWE-23

Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (1)

https://github.com/rancher/fleet/security/advisories/GHSA-c45g-6c2c-rj3p

Source: meissner@suse.de

Vendor AdvisoryMitigation

Timeline

No history available yet.