{"id":"CVE-2026-44948","summary":"Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler","details":"A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.","aliases":["GHSA-c45g-6c2c-rj3p"],"modified":"2026-08-12T03:51:29.494600509Z","published":"2026-06-30T15:12:17.346Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44948.json","cna_assigner":"suse","cwe_ids":["CWE-23"]},"references":[{"type":"WEB","url":"https://github.com/rancher/fleet/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44948.json"},{"type":"ADVISORY","url":"https://github.com/rancher/fleet/security/advisories/GHSA-c45g-6c2c-rj3p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44948"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rancher/fleet","events":[{"introduced":"3d1fa6c06ff392c9fa66ca2f46831e2dae23bc16"},{"fixed":"4e6d4da0a68ac8b0fac7b975923b76b9305b6b48"},{"introduced":"e0324f2d4c06dad05a298622a1276ea596367b6a"},{"fixed":"2e3c8d9e5fac06cc140e8c43470ead0af71c2d5e"},{"introduced":"53de8d76a46c737f4b055dd1a7f2b7ac682537c5"},{"fixed":"300f361c919d0c4724f3d7994d32661c8c8a90f7"},{"introduced":"c63dc4bb52acb88fea50fe1b5f20db7f3ca6c9d9"},{"fixed":"5f5c8cbd649222c63f0bb9113ec56181bad2c14f"}],"database_specific":{"extracted_events":[{"introduced":"0.12.0"},{"fixed":"0.12.16"},{"introduced":"0.13.0"},{"fixed":"0.13.12"},{"introduced":"0.14.0"},{"fixed":"0.14.7"},{"introduced":"0.15.0"},{"fixed":"0.15.3"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.12.16-rc.1","v0.14.7-rc.1","v0.15.3-rc.1","v0.15.3-beta.2","v0.15.3-beta.1","v0.12.15-rc.3","v0.12.15","pkg/apis/v0.12.15-rc.3","pkg/apis/v0.12.15","v0.13.11-rc.2","v0.13.11","pkg/apis/v0.13.11-rc.2","pkg/apis/v0.13.11","v0.14.6-rc.3","v0.14.6","pkg/apis/v0.14.6-rc.3","pkg/apis/v0.14.6","v0.15.2-rc.3","v0.15.2","pkg/apis/v0.15.2-rc.3","pkg/apis/v0.15.2","v0.15.2-rc.2","pkg/apis/v0.15.2-rc.2","v0.12.15-rc.2","pkg/apis/v0.12.15-rc.2","v0.14.6-rc.2","pkg/apis/v0.14.6-rc.2","v0.13.11-rc.1","pkg/apis/v0.13.11-rc.1","v0.12.15-rc.1","v0.14.6-rc.1","v0.14.5-rc.2","v0.14.5","v0.13.10-rc.2","v0.13.10","v0.15.2-rc.1","v0.12.14-rc.2","v0.12.14","v0.15.1-rc.2","v0.15.1","v0.12.14-rc.1","v0.15.1-rc.1","v0.14.5-rc.1","v0.13.10-rc.1","v0.12.14-beta.4","v0.13.10-beta.5","v0.14.5-beta.5","v0.15.1-beta.4","v0.13.10-beta.4","v0.12.14-beta.3","v0.14.5-beta.4","v0.14.5-beta.3","v0.15.1-beta.3","v0.13.10-beta.3","v0.12.14-beta.2","v0.13.10-beta.2","v0.15.1-beta.2","v0.14.5-beta.2","v0.13.10-beta.1","v0.12.14-beta.1","v0.14.5-beta.1","v0.15.1-beta.1","v0.13.9-rc.4","v0.13.9","v0.12.13-rc.3","v0.12.13","v0.14.4-rc.5","v0.14.4","v0.15.0-rc.6","v0.15.0","pkg/apis/v0.15.0","v0.14.4-rc.4","v0.13.9-rc.3","v0.12.13-rc.2","v0.14.4-rc.3","v0.13.9-rc.1","v0.12.13-rc.1","v0.14.4-rc.2","v0.14.4-rc.1","v0.14.4-beta.2","v0.14.4-beta.1","v0.14.3-rc.3","v0.14.3","v0.12.12-rc.2","v0.12.12","pkg/apis/v0.12.12-rc.2","v0.13.8-rc.1","v0.13.8","v0.14.3-rc.2","v0.12.12-rc.1","v0.14.3-rc.1","v0.12.11-rc.3","v0.12.11","v0.13.7-rc.2","v0.13.7","pkg/apis/v0.13.7-rc.2","pkg/apis/v0.13.7","v0.14.3-beta.1","v0.14.2-rc.2","v0.14.2","pkg/apis/v0.14.2-rc.2","pkg/apis/v0.14.2","v0.14.2-rc.1","pkg/apis/v0.14.2-rc.1","v0.12.11-rc.2","v0.13.7-rc.1","pkg/apis/v0.13.7-rc.1","v0.12.11-rc.1","v0.14.2-beta.1","pkg/apis/v0.14.2-beta.1","v0.13.7-alpha.2","v0.13.7-alpha.1","v0.13.6-rc.1","v0.13.6","v0.12.10-rc.1","v0.12.10","v0.14.1-rc.1","v0.14.1","v0.14.1-beta.4","v0.13.6-beta.1","v0.14.1-beta.3","v0.14.1-beta.2","v0.14.1-beta.1","v0.12.9","v0.13.5","v0.14.0","pkg/apis/v0.14.0","v0.13.4-rc.2","v0.13.4","v0.12.9-rc.2","v0.13.5-rc.3","v0.12.9-rc.1","v0.13.5-rc.2","v0.13.5-rc.1","v0.12.9-beta.2","v0.12.9-beta.1","v0.13.5-beta.1","v0.12.8-rc.1","v0.12.8","v0.13.4-rc.1","v0.12.7-rc.2","v0.12.7","v0.13.3","v0.13.2-rc.2","v0.13.2","v0.12.7-rc.1","v0.13.2-rc.1","v0.13.1-rc.6","v0.13.1-rc.5","v0.13.1","v0.13.0-rc.4","v0.13.0","pkg/apis/v0.13.0","v0.12.6-rc.3","v0.12.6","v0.12.6-rc.2","v0.13.1-rc.4","v0.13.1-rc.3","v0.13.1-rc.2","v0.12.6-rc.1","v0.13.1-rc.1","v0.12.6-beta.2","v0.13.1-beta.2","v0.13.1-beta.1","v0.12.6-beta.1","v0.12.5-rc.1","v0.12.5","pkg/apis/v0.12.5","v0.12.4-rc.3","v0.12.4","v0.12.4-rc.2","v0.12.4-rc.1","v0.12.3-rc.1","v0.12.3","pkg/apis/v0.12.3-rc.1","pkg/apis/v0.12.3","v0.12.3-beta.1","pkg/apis/v0.12.3-beta.1","v0.12.2","v0.12.1-rc.1","v0.12.1","pkg/apis/v0.12.1-rc.1","pkg/apis/v0.12.1","v0.12.1-beta.2","v0.12.1-beta.1","pkg/apis/v0.12.1-beta.1","v0.12.0-rc.5","v0.12.0","pkg/apis/v0.12.0-rc.5","pkg/apis/v0.12.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44948.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}