Skip to content
Threat Feed
Subscribe
high advisory

Fission Zip Slip Vulnerability in pkg/utils/zip.go Unarchive Function

The Unarchive function in Fission's pkg/utils/zip.go was vulnerable to a Zip Slip path traversal. An attacker controlling a malicious zip archive's URL could leverage this to write files outside the intended destination directory, potentially leading to overwriting sensitive files, accessing secrets from mounted volumes, or tampering with the fetcher's own binaries, impacting other tenants in a multi-tenant containerized environment. This vulnerability affects Fission versions up to and including v1.24.0 and was fixed in v1.25.0.

A critical Zip Slip vulnerability, identified as CVE-2026-50567, exists in the Unarchive function within pkg/utils/zip.go of the Fission serverless framework. This flaw allows an attacker to perform path traversal by crafting a malicious ZIP archive. When a Fission environment's fission-fetcher sidecar processes an attacker-controlled archive URL (via Package.Spec.Source.URL or Deployment.URL), the filepath.Join operation combines the archive entry name with the destination directory without proper validation. This enables the attacker to write files arbitrarily outside the intended destination. The vulnerability affects all Fission versions up to and including v1.24.0 and was remediated in v1.25.0. Successful exploitation could lead to privilege escalation, data exposure, or service disruption within a Fission deployment, particularly in multi-tenant cloud environments.

Attack Chain

  1. An attacker crafts a malicious ZIP archive containing entries with path traversal sequences, such as ../../tmp/evil, to escape the intended extraction directory.
  2. The attacker hosts this malicious ZIP archive at a URL accessible by the Fission environment.
  3. The attacker injects the URL of the malicious ZIP archive into a Fission Package.Spec.Source.URL or Deployment.URL resource.
  4. The fission-fetcher sidecar, running within a per-environment pod, downloads the attacker-controlled URL, attempting to extract the ZIP archive.
  5. The vulnerable Unarchive function in pkg/utils/zip.go processes the ZIP entries, and due to improper path validation using filepath.Join, resolves the malicious paths to locations outside the intended destination directory.
  6. The fission-fetcher writes files from the malicious archive to arbitrary locations on the host or container filesystem.
  7. Files are written into sensitive locations like other tenants' /packages/<ns>/ directories, mounted secret/config volumes, or overwriting the fission-fetcher's own binaries, leading to impact.

Impact

Successful exploitation of CVE-2026-50567 can have severe consequences for Fission deployments. Attackers can achieve arbitrary file write capabilities, allowing them to overwrite sensitive configuration files, modify binaries, or implant malicious code. In a multi-tenant Fission environment, this could enable an attacker to compromise other tenants' data and functions by writing into their package directories or accessing secrets from mounted volumes. This could lead to data exfiltration, privilege escalation, or complete denial of service. The exact number of affected organizations is not specified, but any Fission instance running versions up to and including v1.24.0 is vulnerable.

Recommendation

  • Upgrade all Fission installations to version v1.25.0 or later immediately to patch CVE-2026-50567.
  • Implement strict input validation for Package.Spec.Source.URL and Deployment.URL to prevent arbitrary URL injection, although this vulnerability is primarily patched via the Fission update.
  • Monitor fission-fetcher logs for any unexpected file write operations or attempts to access directories outside of designated package or temporary storage locations, using file_event log sources.