Executive Summary

CVE-2026-50567 is a Zip Slip vulnerability in the Fission project's Unarchive function located in pkg/utils/zip.go. Prior to version 1.25.0, the function joined each archive entry name with the destination directory path without verifying if the resolved path stayed within the intended destination. This allowed a malicious zip entry with a path like ../../tmp/evil to write files outside the target directory, such as into /tmp/evil.

An attacker who controls a Package.Spec.Source.URL or Deployment.URL archive could exploit this to write files anywhere accessible by the fetcher process, including other tenants' directories, mounted secret or config volumes, or even overwrite the fetcher's own binary.

The vulnerability was fixed in version 1.25.0 by validating archive entries to reject absolute paths, parent directory traversal, and symlinks, and by confining file operations to the destination directory using os.Root.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with the ability to supply package or deployment archives to write arbitrary files outside the intended directory. This can lead to unauthorized modification of files belonging to other tenants, overwriting sensitive mounted secrets or configuration files, or corrupting the fetcher's own executable.

Such unauthorized file writes compromise the integrity of the system and can lead to further exploitation or denial of service. The CVSS v3.1 base score of 7.7 reflects the high impact on integrity with no impact on confidentiality or availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves path traversal in zip archive extraction within the Fission framework's fetcher sidecar. Detection involves identifying if any Package.Spec.Source.URL or Deployment.URL archives contain malicious zip entries with path traversal patterns such as "../../" or absolute paths.

You can inspect zip archives used by Fission for suspicious entries by listing their contents and checking for traversal paths.

• Use the command `unzip -l <archive.zip>` to list the contents of the zip archive and look for entries containing `../` or absolute paths.
• Use `zipinfo <archive.zip>` for a detailed listing of zip entries to detect suspicious file paths.
• Monitor Kubernetes audit logs for creation or modification of Package CRDs or Deployments that reference archives with suspicious URLs.

Additionally, review the fetcher sidecar logs for any errors or unusual file writes outside expected directories.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade the Fission framework to version 1.25.0 or later, where the vulnerability has been fixed.

The fix includes validation of archive entries to reject absolute paths, parent directory traversal, and symlinks, and confines file operations to the destination directory using `os.Root`.

• Upgrade Fission to version 1.25.0 or newer.
• If upgrading immediately is not possible, restrict permissions so that only trusted users can create or modify Package CRDs or Deployments that reference archives.
• Monitor and audit usage of the fetcher sidecar to detect any suspicious activity.

Avoid using untrusted or unauthenticated zip archives as sources for Package.Spec.Source.URL or Deployment.URL.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to write files outside the intended directory, potentially overwriting files in other tenants' directories or mounted secret/config volumes. This unauthorized file modification can lead to integrity violations of sensitive data or configurations.

Such integrity compromises could impact compliance with standards and regulations like GDPR or HIPAA, which require protection of data integrity and confidentiality. Unauthorized file writes to secret or configuration volumes may expose or alter sensitive information, thus violating these regulatory requirements.

However, the provided information does not explicitly discuss compliance impacts or specific regulatory considerations.

Useful 0 Not Useful 0