A path traversal flaw in the compressedEndpoint field of Rancher Extensions allows a malicious UI plugin to write files to arbitrary locations, enabling overwriting of Rancher binaries, configuration files, or data in /var/lib/rancher. The resulting file overwrite can introduce malicious code, corrupt cluster state, or grant further attack leverage. The weakness is identified as CWE‑35, a Path Traversal vulnerability.

The vulnerability affects the Rancher Extensions component provided by SUSE. No specific version information is listed in the official release notes, so all currently deployed instances of Rancher Extensions are potentially impacted until a patch is applied.

The CVSS score of 8.4 classifies the issue as high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, so no confirmed exploitation has been reported yet. However, the attack vector likely requires the creation or deployment of a rogue UI plugin, which may be possible to deploy by users with sufficient cluster permissions. If compromise is achieved, the attacker could achieve remote code execution on the Rancher host or infiltrate node file systems via hostPath volumes. Due to the lack of publicly documented exploits, the current risk is considered high but the exploitation probability remains uncertain.