CVE-2026-50568
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.
Impact
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefix(path, safedir). This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator boundary, so any sibling directory whose name began with the safe-directory string was accepted. Callers included the builder's Clean handler (pkg/builder/builder.go:208) and the fetcher's Fetch / Upload handlers (pkg/fetcher/fetcher.go). A tenant who could pre-create or control a sibling directory under the fetcher / builder's shared volume could induce a write or read outside the intended safe directory. This issue has been patched in version 1.25.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/fission/fission | <= 1.24.0 | 1.25.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-r5jh-q2mw-gcx4
- https://github.com/fission/fission/security/advisories/GHSA-r5jh-q2mw-gcx4
- https://nvd.nist.gov/vuln/detail/CVE-2026-50568
- https://github.com/fission/fission/pull/3445
- https://github.com/fission/fission/pull/3446
- https://github.com/fission/fission/commit/5aac6f0bcdf840e28f3f06c846ca7ae1866b3957
- https://github.com/fission/fission/commit/8298e33ea7457702f893eae11077987cf905edb4
- https://github.com/fission/fission/releases/tag/v1.25.0