GHSA-q6vm-xqc9-v3ff is a high-severity (CVSS 7.7) Path Traversal vulnerability in github.com/fission/fission. A fix is available for github.com/fission/fission — see the affected versions and patch details below.
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-q6vm-xqc9-v3ff.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-q6vm-xqc9-v3ff by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 379,842 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
github.com/fission/fissionReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named
../../tmp/evil therefore landed at /tmp/evil. An attacker who could control a Package.Spec.Source.URL or Deployment.URL archive could induce the fetcher (running as the per-environment pod's fission-fetcher sidecar) to write
files anywhere that process could reach: into other tenants' /packages/<ns>/ directories, into mounted secret/config volumes, or into the fetcher's own binary.
Affected
- Project:
github.com/fission/fission - Versions: all up to and including v1.24.0
- Audited commit:
647c141 - Component:
pkg/utils/zip.go(Unarchive) - Configuration: default; triggered when the fetcher downloads and extracts a zip archive
Fix section (paste into the Fix / Patches field)
Fixed in v1.25.0 by:
- PR #3444 (commit
55704aca) —Unarchivenow opens anos.Rooton the destination, validates each archive entry name (rejects absolute paths and..traversal), and refuses symlink entries up front. Theos.Rootconfines everymkdir/createto the destination in the kernel.
Regression coverage: TestUnarchiveZipSlip in pkg/utils/zip_test.go exercises parent-traversal, absolute-path, and symlink entries.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/fission/fission | all versions | 1.25.0go get github.com/fission/fission@v1.25.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/fission/fission, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/fission/fission to 1.25.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-q6vm-xqc9-v3ff is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Frequently Asked Questions
Is GHSA-q6vm-xqc9-v3ff in your dependencies?
Find it across Go, including transitive dependencies.