CVE-2026-50568 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

What is CVE-2026-50568?

CVE-2026-50568 is a low-severity path traversal vulnerability in fission, published on 10 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefix(path, safedir). This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator boundary, so any sibling directory whose name began with the safe-directory string was accepted. Callers included the builder's Clean handler (pkg/builder/builder.go:208) and the fetcher's Fetch / Upload handlers (pkg/fetcher/fetcher.go). A tenant who could pre-create or control a sibling directory under the fetcher / builder's shared volume could induce a write or read outside the intended safe directory. This issue has been patched in version 1.25.0.

Weakness: CWE-41

Which versions are affected by CVE-2026-50568?

3 open source packages ship an affected version, including github.com/fission/fission.

How do I fix CVE-2026-50568?

Upgrade github.com/fission/fission to 1.25.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-50568 being exploited?

There is no known exploitation of CVE-2026-50568 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r5jh-q2mw-gcx4, GO-2026-6130.