https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:28:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-270831 EUVD-2026-270831 https://cve.radiocsirt.org/vuln/euvd-2026-270831 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62878 <p>A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories.</p> <p>A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-62878 https://cve.radiocsirt.org/vuln/ghsa-jr3w-9vfr-c746 <p><strong>Affected:</strong> Go: github.com/rancher/local-path-provisioner</p> <p>### Impact</p> <p>A malicious user can manipulate the [parameters.pathPattern](https://github.com/rancher/local-path-provisioner/blob/d4f71b4b03a321e9f54be00808e9de42b8bfd35a/provisioner.go#L381) to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories.</p> <p>Example: ``` apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: &gt; {&#34;apiVersion&#34;:&#34;storage.k8s.io/v1&#34;,&#34;kind&#34;:&#34;StorageClass&#34;,&#34;metadata&#34;:{&#34;annotations&#34;:{},&#34;name&#34;:&#34;local-path&#34;},&#34;provisioner&#34;:&#34;rancher.io/local-path&#34;,&#34;reclaimPolicy&#34;:&#34;Delete&#34;,&#34;volumeBindingMode&#34;:&#34;WaitForFirstConsumer&#34;} storageclass.kubernetes.io/is-default-class: &#39;true&#39; name: local-path provisioner: rancher.io/local-path reclaimPolicy: Delete parameters: pathPattern: &#34;{{ .PVC.Namespace }}/{{ .PVC.Name }}/../../../../../etc/new-dir&#34; volumeBindingMode: WaitForFirstConsumer Results in the PersistentVolume to target /etc/new-dir: ``` This produces a PersistentVolume that points to `/etc/new-dir`, instead of a path under the configured base directory.</p> <p>Expected Behavior: - Paths generated from pathPattern should always resolve under the configured base path. - Relative path elements (e.g., ..) should be normalized or rejected.</p> <p>### Patches</p> <p>This vulnerability is addressed by validating and normalizing the `parameters.pathPattern` to ensure that generated PersistentVolume paths always resolve…</p> <p><strong>Affected:</strong> Go: github.com/rancher/local-path-provisioner</p> <p>### Impact</p> <p>A malicious user can manipulate the [parameters.pathPattern](https://github.com/rancher/local-path-provisioner/blob/d4f71b4b03a321e9f54be00808e9de42b8bfd35a/provisioner.go#L381) to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories.</p> <p>Example: ``` apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: &gt; {&#34;apiVersion&#34;:&#34;storage.k8s.io/v1&#34;,&#34;kind&#34;:&#34;StorageClass&#34;,&#34;metadata&#34;:{&#34;annotations&#34;:{},&#34;name&#34;:&#34;local-path&#34;},&#34;provisioner&#34;:&#34;rancher.io/local-path&#34;,&#34;reclaimPolicy&#34;:&#34;Delete&#34;,&#34;volumeBindingMode&#34;:&#34;WaitForFirstConsumer&#34;} storageclass.kubernetes.io/is-default-class: &#39;true&#39; name: local-path provisioner: rancher.io/local-path reclaimPolicy: Delete parameters: pathPattern: &#34;{{ .PVC.Namespace }}/{{ .PVC.Name }}/../../../../../etc/new-dir&#34; volumeBindingMode: WaitForFirstConsumer Results in the PersistentVolume to target /etc/new-dir: ``` This produces a PersistentVolume that points to `/etc/new-dir`, instead of a path under the configured base directory.</p> <p>Expected Behavior: - Paths generated from pathPattern should always resolve under the configured base path. - Relative path elements (e.g., ..) should be normalized or rejected.</p> <p>### Patches</p> <p>This vulnerability is addressed by validating and normalizing the `parameters.pathPattern` to ensure that generated PersistentVolume paths always resolve…</p> https://cve.radiocsirt.org/vuln/ghsa-jr3w-9vfr-c746 https://cve.radiocsirt.org/vuln/msrc_cve-2025-62878 msrc_CVE-2025-62878 https://cve.radiocsirt.org/vuln/msrc_cve-2025-62878 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0344 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Rancher Local Path Provisioner ausnutzen, um Dateien zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Rancher Local Path Provisioner ausnutzen, um Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0344