{"id":"GHSA-q6vm-xqc9-v3ff","summary":" Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory","details":"`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named\n  `../../tmp/evil` therefore landed at `/tmp/evil`. An attacker who could control a `Package.Spec.Source.URL` or `Deployment.URL` archive could induce the fetcher (running as the per-environment pod's `fission-fetcher` sidecar) to write\n  files anywhere that process could reach: into other tenants' `/packages/\u003cns\u003e/` directories, into mounted secret/config volumes, or into the fetcher's own binary.\n\n  ### Affected\n\n  - Project: `github.com/fission/fission`\n  - Versions: all up to and including v1.24.0\n  - Audited commit: `647c141`\n  - Component: `pkg/utils/zip.go` (`Unarchive`)\n  - Configuration: default; triggered when the fetcher downloads and extracts a zip archive\n\n  Fix section (paste into the Fix / Patches field)\n\n  Fixed in [v1.25.0](https://github.com/fission/fission/releases/tag/v1.25.0) by:\n\n  - [PR #3444](https://github.com/fission/fission/pull/3444) (commit [`55704aca`](https://github.com/fission/fission/commit/55704aca1b8d6f45bc7c7c2e4805c7e14875ec0f)) — `Unarchive` now opens an `os.Root` on the destination, validates each\n  archive entry name (rejects absolute paths and `..` traversal), and refuses symlink entries up front. The `os.Root` confines every `mkdir` / `create` to the destination in the kernel.\n\n  Regression coverage: `TestUnarchiveZipSlip` in `pkg/utils/zip_test.go` exercises parent-traversal, absolute-path, and symlink entries.","aliases":["CVE-2026-50567","GO-2026-6127"],"modified":"2026-08-24T00:37:04.812555917Z","published":"2026-07-28T20:16:52Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-07-28T20:16:52Z","nvd_published_at":"2026-06-10T18:17:13Z","cwe_ids":["CWE-22"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/fission/fission/security/advisories/GHSA-q6vm-xqc9-v3ff"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50567"},{"type":"WEB","url":"https://github.com/fission/fission/pull/3444"},{"type":"PACKAGE","url":"https://github.com/fission/fission"},{"type":"WEB","url":"https://github.com/fission/fission/releases/tag/v1.25.0"}],"affected":[{"package":{"name":"github.com/fission/fission","ecosystem":"Go","purl":"pkg:golang/github.com/fission/fission"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.24.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-q6vm-xqc9-v3ff/GHSA-q6vm-xqc9-v3ff.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"}]}