CVE-2026-44948CWE-23

CVE-2026-44948

Medium · published June 30, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00487 · 41.0th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-06-30T20:16Z
Affected products (4)
ProductVersionsFixed in
suse/rancher_fleet≥ 0.14.0, < 0.14.70.14.7
suse/rancher_fleet≥ 0.15.0, < 0.15.30.15.3
suse/rancher_fleet≥ 0.12.0, < 0.12.160.12.16
suse/rancher_fleet≥ 0.13.0, < 0.13.120.13.12
References (1)
https://github.com/rancher/fleet/security/advisories/GHSA-c45g-6c2c-rj3p · [email protected]
EPSS history
Timeline
  • 30 JUN 15:12Z
    Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler
    cvelistv5