CVE-2026-44948

A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.

Score

CVSS 4.0 5.3 Medium

Status

Analyzed - meissner@suse.de

Published

2026-06-30

Last modified

2026-10-25

Weaknesses

CWE-23

Affected products

• Rancher (Suse)
• Rancher Fleet (Suse)

References

• https://github.com/rancher/fleet/security/advisories/GHSA-c45g-6c2c-rj3p