CVE-2026-50567: Fission Path Traversal Vulnerability

CVE-2026-50567 Overview

CVE-2026-50567 is a path traversal vulnerability [CWE-22] in Fission, an open-source Kubernetes-native serverless framework. The flaw resides in the Unarchive function within pkg/utils/zip.go. The function joined archive entry names with the destination directory using filepath.Join without validating that the resolved path remained within the destination boundary. A malicious archive entry such as ../../tmp/evil would be written to /tmp/evil. Versions prior to 1.25.0 are affected.

Critical Impact
An attacker controlling a Package.Spec.Source.URL or Deployment.URL archive can write arbitrary files through the fission-fetcher sidecar, including into other tenants' package directories, mounted secret volumes, or the fetcher binary itself.

Affected Products

Fission (Kubernetes-native serverless framework) versions prior to 1.25.0
fission-fetcher sidecar component in per-environment pods
Multi-tenant Fission deployments processing user-supplied archive URLs

Discovery Timeline

2026-06-10 - CVE-2026-50567 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-50567

Vulnerability Analysis

The vulnerability is a classic Zip Slip path traversal in the Fission archive extraction routine. The Unarchive function in pkg/utils/zip.go iterates over entries in a user-supplied archive and constructs each destination path using filepath.Join(destDir, entry.Name). Go's filepath.Join normalizes and cleans the resulting path but does not prevent the result from escaping the destination directory when the entry name contains relative traversal sequences like ../.

The extraction code then writes the entry contents to the resolved path without verifying that the path is a child of the intended destination. This allows an archive entry named ../../tmp/evil to be written to /tmp/evil, completely bypassing the intended sandbox boundary.

Root Cause

The root cause is missing path containment validation after path joining. Secure archive extraction requires verifying that the cleaned destination path has the destination directory as a prefix before any file write occurs. Fission omitted this check, treating archive entry names as trusted input.

Attack Vector

An authenticated attacker with permission to create or update Fission Package or Deployment resources supplies a crafted ZIP archive URL in Package.Spec.Source.URL or Deployment.URL. When the fission-fetcher sidecar downloads and extracts the archive, malicious entries with ../ sequences write files outside the intended package directory. Targets include other tenants' /packages/<ns>/ directories, mounted Kubernetes secret and ConfigMap volumes accessible to the fetcher pod, and the fetcher's own binary on disk. Overwriting the fetcher binary enables code substitution on subsequent invocations.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-q6vm-xqc9-v3ff for technical details.

Detection Methods for CVE-2026-50567

Indicators of Compromise

Files present in /packages/<ns>/ directories belonging to namespaces other than the one that owned the originating Package resource
Unexpected modifications to mounted secret or ConfigMap volumes inside fission-fetcher sidecar containers
Hash or timestamp changes to the fission-fetcher binary at runtime
Fission Package or Deployment resources referencing external archive URLs from untrusted sources

Detection Strategies

Audit Kubernetes API server logs for Package and Deployment resource creations referencing external archive URLs
Inspect archives referenced by Fission resources for entries containing ../ sequences or absolute paths
Monitor filesystem activity inside fission-fetcher pods for writes outside the expected /packages/<ns>/ working directory

Monitoring Recommendations

Enable Kubernetes audit logging for fission.io API group resources and alert on Package or Deployment URL changes
Deploy runtime workload security to flag file writes by fission-fetcher to secret mount points or binary paths
Track integrity of the fission-fetcher binary using file integrity monitoring inside environment pods

How to Mitigate CVE-2026-50567

Immediate Actions Required

Upgrade Fission to version 1.25.0 or later on all clusters running the framework
Audit existing Package and Deployment resources for archive URLs sourced from untrusted users or external locations
Rotate any Kubernetes secrets mounted into fission-fetcher sidecars that may have been overwritten or exfiltrated
Restrict RBAC permissions to create or modify Fission Package and Deployment resources to trusted service accounts

Patch Information

The issue is patched in Fission version 1.25.0. The fix is published in GitHub Pull Request #3444 and released in Fission v1.25.0. The patched Unarchive function validates that each resolved entry path remains within the destination directory before writing.

Workarounds

Block external archive URL sources at the network policy or admission controller layer until upgrade is possible
Use an admission webhook to reject Package.Spec.Source.URL and Deployment.URL values pointing to untrusted hosts
Run separate Fission environments per tenant to limit blast radius from cross-tenant file writes

bash

# Upgrade Fission to the patched release
helm repo update
helm upgrade --install fission fission-charts/fission-all \
  --namespace fission \
  --version 1.25.0

# Verify the running fetcher image version
kubectl get pods -n fission -o jsonpath='{.items[*].spec.containers[*].image}' \
  | tr ' ' '\n' | grep fetcher