Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN121
_____________________________________________________________________

DATE                : 05/02/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running rancher/local-path-provisioner 
                            versions prior to 0.0.34.

=====================================================================
https://github.com/rancher/local-path-provisioner/security/advisories/GHSA-jr3w-9vfr-c746
_____________________________________________________________________

Vulnerable to path traversal via parameters.pathPattern
Critical
macedogm published GHSA-jr3w-9vfr-c746 Feb 4, 2026

Package
github.com/rancher/local-path-provisioner (Go)

Affected versions
< 0.0.34

Patched versions
v0.0.34


Description

Impact

A malicious user can manipulate the parameters.pathPattern to create 
PersistentVolumes in arbitrary locations on the host node, potentially 
overwriting sensitive files or gaining access to unintended 
directories.

Example:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: >
      
{"apiVersion":"storage.k8s.io/v1","kind":"StorageClass","metadata
":{"annotations":{},"name":"local-path"},"provisioner":"rancher.i
o/local-path","reclaimPolicy":"Delete","volumeBindingMode":"WaitF
orFirstConsumer"}
    storageclass.kubernetes.io/is-default-class: 'true'
  name: local-path
provisioner: rancher.io/local-path
reclaimPolicy: Delete
parameters:
  pathPattern: "{{ .PVC.Namespace }}/{{ .PVC.Name 
}}/../../../../../etc/new-dir"
volumeBindingMode: WaitForFirstConsumer
Results in the PersistentVolume to target /etc/new-dir:

This produces a PersistentVolume that points to /etc/new-dir, instead 
of a path under the configured base directory.

Expected Behavior:

    Paths generated from pathPattern should always resolve under the 
configured base path.
    Relative path elements (e.g., ..) should be normalized or rejected.

Patches

This vulnerability is addressed by validating and normalizing the 
parameters.pathPattern to ensure that generated PersistentVolume paths 
always resolve under the configured base directory. Any path traversal 
attempts using relative path elements are rejected, preventing 
PersistentVolumes from being created in arbitrary locations on the 
host node.

Previously, a malicious user could manipulate pathPattern to escape 
the base path and create volumes pointing to sensitive or unintended 
directories (for example, /etc), potentially overwriting host files or 
gaining unauthorized access.

With this fix, path patterns that resolve outside of the base 
directory are denied, and only safe, normalized paths under the 
configured base path are allowed.

Patched versions of local-path-provisioner include releases v0.0.34 
(and later).

No patches are provided for earlier releases, as they do not include 
the necessary path validation and normalization logic.
Workarounds

There are no workarounds for this issue. Users must upgrade to a 
patched version of local-path-provisioner to fully mitigate the 
vulnerability.
References

If you have any questions or comments about this advisory:

    Contact the SUSE Rancher Security team for security related 
inquiries.
    Open an issue in the Rancher repository.


Severity
Critical
10.0/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE ID
CVE-2025-62878

Weaknesses
Weakness CWE-23 
=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================