{"id":"CVE-2026-50567","aliases":["GHSA-q6vm-xqc9-v3ff","GO-2026-6127"],"url":"https://o3.security/vulnerability/CVE-2026-50567","summary":"Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory","details":"`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named\n  `../../tmp/evil` therefore landed at `/tmp/evil`. An attacker who could control a `Package.Spec.Source.URL` or `Deployment.URL` archive could induce the fetcher (running as the per-environment pod's `fission-fetcher` sidecar) to write\n  files anywhere that process could reach: into other tenants' `/packages/<ns>/` directories, into mounted secret/config volumes, or into the fetcher's own binary.\n\n  ### Affected\n\n  - Project: `github.com/fission/fission`\n  - Versions: all up to and including v1.24.0\n  - Audited commit: `647c141`\n  - Component: `pkg/utils/zip.go` (`Unarchive`)\n  - Configuration: default; triggered when the fetcher downloads and extracts a zip archive\n\n  Fix section (paste into the Fix / Patches field)\n\n  Fixed in [v1.25.0](https://github.com/fission/fission/releases/tag/v1.25.0) by:\n\n  - [PR #3444](https://github.com/fission/fission/pull/3444) (commit [`55704aca`](https://github.com/fission/fission/commit/55704aca1b8d6f45bc7c7c2e4805c7e14875ec0f)) — `Unarchive` now opens an `os.Root` on the destination, validates each\n  archive entry name (rejects absolute paths and `..` traversal), and refuses symlink entries up front. The `os.Root` confines every `mkdir` / `create` to the destination in the kernel.\n\n  Regression coverage: `TestUnarchiveZipSlip` in `pkg/utils/zip_test.go` exercises parent-traversal, absolute-path, and symlink entries.","published":"2026-06-10T17:30:45.695Z","modified":"2026-09-09T18:26:42.670265529Z","cvss":{"score":7.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"},"epss":{"score":0.00301,"percentile":0.2269,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/fission/fission","fixedVersion":"1.25.0"}],"fix":{"url":"https://github.com/fission/fission/pull/3444","label":"fission/fission#3444"},"references":[{"type":"WEB","url":"https://github.com/fission/fission/releases/tag/v1.25.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50567.json"},{"type":"ADVISORY","url":"https://github.com/fission/fission/security/advisories/GHSA-q6vm-xqc9-v3ff"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50567"},{"type":"FIX","url":"https://github.com/fission/fission/pull/3444"},{"type":"PACKAGE","url":"https://github.com/fission/fission"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-09T18:26:42.670265529Z"}}