CVE-2026-50568

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.25.0

Description Fission is a Kubernetes-native serverless framework. The SanitizeFilePath() function in pkg/utils/utils.go performs a lexical check using strings.HasPrefix(path, safedir) to ensure a path remains within a safe directory. Because it does not enforce a path-separator boundary, any sibling directory starting with the safe-directory string is accepted. This allows a tenant with control over a sibling directory under the shared volume of the builder or fetcher to perform read or write operations outside the intended safe directory. Affected components include the builder's Clean handler and the fetcher's Fetch and Upload handlers.

Recommendations Update to version 1.25.0.