CVE-2026-50567

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.25.0

Description Fission is a Kubernetes-native serverless framework. The Unarchive() function in pkg/utils/zip.go fails to validate if the resolved path of an archive entry remains within the destination directory when using filepath.Join. This allows a Zip Slip attack, where a specially crafted zip entry (e.g., ../../tmp/evil) can be written outside the intended directory. An attacker controlling the Package.Spec.Source.URL or Deployment.URL archive can force the fission-fetcher sidecar to write files to arbitrary locations accessible by the process, such as other tenants' /packages/<ns>/ directories, mounted secret/config volumes, or the fetcher's own binary.

Recommendations Update to version 1.25.0.