CVE-2025-62878

9.9 criticalEPSS 0.6%

Critical (9.9). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/rancher/local-path-provisioner 0.0.34.

A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories.

Severity

CVSS 3.1

9.9 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-23
Published: 2026-02-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-jr3w-9vfr-c746	Go	github.com/rancher/local-path-provisioner	<0.0.34	0.0.34
GO-2026-4425	Go	github.com/rancher/local-path-provisioner	<0.0.34	0.0.34

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62878
https://github.com/advisories/GHSA-jr3w-9vfr-c746

Check your stack JSON