CVE-2026-50567 Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
Attackers can write arbitrary files outside the destination directory via malicious zip archives, potentially compromising other tenants or executing code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50567?
CVE-2026-50567 is a high-severity path traversal vulnerability in fission, published on 10 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control a Package.Spec.Source.URL or Deployment.URL archive could induce the fetcher (running as the per-environment pod's fission-fetcher sidecar) to write files anywhere that process could reach: into other tenants' /packages/<ns>/ directories, into mounted secret/config volumes, or into the fetcher's own binary. This issue has been patched in version 1.25.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-50567?
3 open source packages ship an affected version, including github.com/fission/fission.
| Package | Affected | Fixed in |
|---|---|---|
github.com/fission/fission Go | All versions | 1.25.0 |
github.com/fission/fission Go | All versions | 1.25.0 |
github.com/fission/fission Go | All versions | 1.25.0 |
How do I fix CVE-2026-50567?
Upgrade github.com/fission/fission to 1.25.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-50567 being exploited?
There is no known exploitation of CVE-2026-50567 in the wild and no public exploit code.
Sources
Also known as GHSA-q6vm-xqc9-v3ff, GO-2026-6127.