LOW 3.6 GitHub
CVE-2026-50568
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
`SanitizeFilePath` in `pkg/utils/utils.go` validated that a path stayed under a safe directory by calling `strings.HasPrefix(path, safedir)`. This is a lexical check, not a directory boundary check: `/packages-extra/evil` starts with
`/packages`, so it passed. The function did not enforce a path-separator boundary, so any sibling directory whose name began with the safe-directory string was accepted.
Callers included the builder's `Clean` handler (`pkg/builder/builder.go:208`) and the fetcher's
Affected Products
- go/github.com/fission/fission <= 1.24.0
References
- https://github.com/advisories/GHSA-r5jh-q2mw-gcx4
- https://github.com/fission/fission/security/advisories/GHSA-r5jh-q2mw-gcx4
- https://nvd.nist.gov/vuln/detail/CVE-2026-50568
- https://github.com/fission/fission/pull/3445
This low severity vulnerability with a CVSS score of 3.6 was published on 2026-07-28 via GitHub. Affected: go/github.com/fission/fission <= 1.24.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.