Executive brief
Fission is a serverless framework for Kubernetes. A vulnerability in its archive extraction utility allows an attacker to write malicious files outside of the intended directory by providing a specially crafted ZIP file. This could lead to the overwriting of sensitive system files, configuration secrets, or the application's own binary, potentially compromising the entire environment or other users' data.
Technical details
A path traversal vulnerability, commonly known as 'Zip Slip', exists in the `Unarchive` function within `pkg/utils/zip.go`. The component uses `filepath.Join` to combine archive entry names with the destination directory without verifying if the resulting path remains within the target boundaries. An attacker who can control a `Package.Spec.Source.URL` or `Deployment.URL` can provide a ZIP archive containing entries with `../` sequences. This allows the `fission-fetcher` sidecar to write files to arbitrary locations accessible to the process, including mounted secret volumes or other tenant directories. The issue is fixed in version 1.25.0 by implementing `os.Root` for directory confinement and validating entry names against traversal sequences and symlinks.
Affected products
- fission fission <= 1.24.0
Timeline
- 2026-06-08: disclosed
- 2026-06-10: advisory: NVD publication
- 2026-07-28: patched: GitHub Advisory updated/published