A path traversal vulnerability exists in the ImageScan subsystem of Rancher Fleet. The flaw allows an attacker to navigate outside the intended file system location when accessing the GitRepo Path handler, potentially causing the service to become unreachable and leading to a denial of service. The weakness is classified as CWE‑23, a classic directory traversal flaw that bypasses directory boundaries.

The vulnerability affects SUSE Rancher’s Fleet product. Versions 0.12.0 through 0.12.16, 0.13.0 through 0.13.12, 0.14.0 through 0.14.7, and 0.15.0 through 0.15.3 are susceptible. Users running any of these releases should verify their fleet component version.

The CVSS base score of 5.3 indicates moderate severity, and no EPSS score is available, implying that the exploitation likelihood is not quantified. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly described in the CVE description; it is inferred that the path traversal could be exploited via network access if the Fleet API is exposed or through a local compromise that allows input to the ImageScan subsystem.