CVE-2025-62878CWE-23

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

Critical · published February 25, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00604 · 48.2th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-02-25T10:49Z
EPSS history
Timeline
  • 25 FEB 10:49Z
    Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
    cvelistv5