{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/fission--1.24.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-50567"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Fission \u003c= 1.24.0"],"_cs_severities":["high"],"_cs_tags":["zip-slip","path-traversal","vulnerability","cloud","linux"],"_cs_type":"advisory","_cs_vendors":["Fission"],"content_html":"\u003cp\u003eA critical Zip Slip vulnerability, identified as CVE-2026-50567, exists in the \u003ccode\u003eUnarchive\u003c/code\u003e function within \u003ccode\u003epkg/utils/zip.go\u003c/code\u003e of the Fission serverless framework. This flaw allows an attacker to perform path traversal by crafting a malicious ZIP archive. When a Fission environment's \u003ccode\u003efission-fetcher\u003c/code\u003e sidecar processes an attacker-controlled archive URL (via \u003ccode\u003ePackage.Spec.Source.URL\u003c/code\u003e or \u003ccode\u003eDeployment.URL\u003c/code\u003e), the \u003ccode\u003efilepath.Join\u003c/code\u003e operation combines the archive entry name with the destination directory without proper validation. This enables the attacker to write files arbitrarily outside the intended destination. The vulnerability affects all Fission versions up to and including v1.24.0 and was remediated in v1.25.0. Successful exploitation could lead to privilege escalation, data exposure, or service disruption within a Fission deployment, particularly in multi-tenant cloud environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious ZIP archive containing entries with path traversal sequences, such as \u003ccode\u003e../../tmp/evil\u003c/code\u003e, to escape the intended extraction directory.\u003c/li\u003e\n\u003cli\u003eThe attacker hosts this malicious ZIP archive at a URL accessible by the Fission environment.\u003c/li\u003e\n\u003cli\u003eThe attacker injects the URL of the malicious ZIP archive into a Fission \u003ccode\u003ePackage.Spec.Source.URL\u003c/code\u003e or \u003ccode\u003eDeployment.URL\u003c/code\u003e resource.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efission-fetcher\u003c/code\u003e sidecar, running within a per-environment pod, downloads the attacker-controlled URL, attempting to extract the ZIP archive.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003eUnarchive\u003c/code\u003e function in \u003ccode\u003epkg/utils/zip.go\u003c/code\u003e processes the ZIP entries, and due to improper path validation using \u003ccode\u003efilepath.Join\u003c/code\u003e, resolves the malicious paths to locations outside the intended destination directory.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efission-fetcher\u003c/code\u003e writes files from the malicious archive to arbitrary locations on the host or container filesystem.\u003c/li\u003e\n\u003cli\u003eFiles are written into sensitive locations like other tenants' \u003ccode\u003e/packages/\u0026lt;ns\u0026gt;/\u003c/code\u003e directories, mounted secret/config volumes, or overwriting the \u003ccode\u003efission-fetcher\u003c/code\u003e's own binaries, leading to impact.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-50567 can have severe consequences for Fission deployments. Attackers can achieve arbitrary file write capabilities, allowing them to overwrite sensitive configuration files, modify binaries, or implant malicious code. In a multi-tenant Fission environment, this could enable an attacker to compromise other tenants' data and functions by writing into their package directories or accessing secrets from mounted volumes. This could lead to data exfiltration, privilege escalation, or complete denial of service. The exact number of affected organizations is not specified, but any Fission instance running versions up to and including v1.24.0 is vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Fission installations to version v1.25.0 or later immediately to patch CVE-2026-50567.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for \u003ccode\u003ePackage.Spec.Source.URL\u003c/code\u003e and \u003ccode\u003eDeployment.URL\u003c/code\u003e to prevent arbitrary URL injection, although this vulnerability is primarily patched via the Fission update.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003efission-fetcher\u003c/code\u003e logs for any unexpected file write operations or attempts to access directories outside of designated package or temporary storage locations, using file_event log sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T20:18:10Z","date_published":"2026-07-28T20:18:10Z","id":"https://feed.craftedsignal.io/briefs/2026-07-fission-zip-slip-vulnerability/","summary":"The Unarchive function in Fission's pkg/utils/zip.go was vulnerable to a Zip Slip path traversal. An attacker controlling a malicious zip archive's URL could leverage this to write files outside the intended destination directory, potentially leading to overwriting sensitive files, accessing secrets from mounted volumes, or tampering with the fetcher's own binaries, impacting other tenants in a multi-tenant containerized environment. This vulnerability affects Fission versions up to and including v1.24.0 and was fixed in v1.25.0.","title":"Fission Zip Slip Vulnerability in pkg/utils/zip.go Unarchive Function","url":"https://feed.craftedsignal.io/briefs/2026-07-fission-zip-slip-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Fission \u003c= 1.24.0","version":"https://jsonfeed.org/version/1.1"}