HIGH 7.7 GitHub
CVE-2026-50567
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named
`../../tmp/evil` therefore landed at `/tmp/evil`. An attacker who could control a `Package.Spec.Source.URL` or `Deployment.URL` archive could induce the fetcher (running as the per-environment pod's `fission-fetcher` sidecar) to write
files anywhere that process could
Affected Products
- go/github.com/fission/fission <= 1.24.0
References
- https://github.com/advisories/GHSA-q6vm-xqc9-v3ff
- https://github.com/fission/fission/security/advisories/GHSA-q6vm-xqc9-v3ff
- https://nvd.nist.gov/vuln/detail/CVE-2026-50567
- https://github.com/fission/fission/pull/3444
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-07-28 via GitHub. Affected: go/github.com/fission/fission <= 1.24.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.