CVE-2025-62878

A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories.

Score

CVSS 3.1 9.9 Critical

Status

Deferred - meissner@suse.de

Published

2026-02-25

Last modified

2026-02-26

Weaknesses

CWE-23

Affected products

• Rancher (Suse)

References

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62878
• https://github.com/advisories/GHSA-jr3w-9vfr-c746