Attack Chain

1. An attacker crafts a malicious ZIP archive containing entries with path traversal sequences, such as ../../tmp/evil, to escape the intended extraction directory.
2. The attacker hosts this malicious ZIP archive at a URL accessible by the Fission environment.
3. The attacker injects the URL of the malicious ZIP archive into a Fission Package.Spec.Source.URL or Deployment.URL resource.
4. The fission-fetcher sidecar, running within a per-environment pod, downloads the attacker-controlled URL, attempting to extract the ZIP archive.
5. The vulnerable Unarchive function in pkg/utils/zip.go processes the ZIP entries, and due to improper path validation using filepath.Join, resolves the malicious paths to locations outside the intended destination directory.
6. The fission-fetcher writes files from the malicious archive to arbitrary locations on the host or container filesystem.
7. Files are written into sensitive locations like other tenants' /packages/<ns>/ directories, mounted secret/config volumes, or overwriting the fission-fetcher's own binaries, leading to impact.

Impact

Successful exploitation of CVE-2026-50567 can have severe consequences for Fission deployments. Attackers can achieve arbitrary file write capabilities, allowing them to overwrite sensitive configuration files, modify binaries, or implant malicious code. In a multi-tenant Fission environment, this could enable an attacker to compromise other tenants' data and functions by writing into their package directories or accessing secrets from mounted volumes. This could lead to data exfiltration, privilege escalation, or complete denial of service. The exact number of affected organizations is not specified, but any Fission instance running versions up to and including v1.24.0 is vulnerable.

Recommendation

• Upgrade all Fission installations to version v1.25.0 or later immediately to patch CVE-2026-50567.
• Implement strict input validation for Package.Spec.Source.URL and Deployment.URL to prevent arbitrary URL injection, although this vulnerability is primarily patched via the Fission update.
• Monitor fission-fetcher logs for any unexpected file write operations or attempts to access directories outside of designated package or temporary storage locations, using file_event log sources.