# CVE-2026-52832: Nuclio Dashboard path traversal in spec.handler allows arbitrary file write

Source: https://junglewise.ai/threats/cve-2026-52832-nuclio-dashboard-path-traversal-in-spec-handler-allows-arbitrary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-52832 · Severity: medium · CVSS 4.9 · Published 2026-09-02

Nuclio, an open-source serverless platform, contains a vulnerability in its Dashboard component that allows unauthenticated users to write files to any location within the Dashboard's container. Because the Dashboard process runs with administrative (root) privileges, an attacker could overwrite critical system files or configuration settings. This could lead to a complete takeover of the container and potentially allow the attacker to gain broader access to the underlying Kubernetes cluster.

Technologies: [github.com/nuclio/nuclio (Go)](https://junglewise.ai/threats/technologies/github-com-nuclio-nuclio), [Nuclio](https://junglewise.ai/threats/technologies/nuclio). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Nuclio](https://junglewise.ai/threats/vendors/nuclio).

## Quick answers

**Is CVE-2026-52832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52832 being exploited in the wild.

**How severe is CVE-2026-52832?** Medium severity, with a CVSS score of 4.9, published 2 September 2026.

**Which products and versions are affected?** github.com/nuclio/nuclio (Go) < 1.16.5, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.16.5; Nuclio <= 1.15.27.

**Is there a fix for CVE-2026-52832?** Yes. github.com/nuclio/nuclio (Go): upgrade to 1.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52832 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52832?** Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/nuclio/nuclio (Go): upgrade to 1.16.5 or later

  ```sh
  go get github.com/nuclio/nuclio@v1.16.5
  ```


## Technical details

A path traversal vulnerability exists in the Nuclio Dashboard's 'POST /api/functions' endpoint. The 'spec.handler' field is parsed by 'functionconfig.ParseHandler()' without path validation. During the build process, 'writeFunctionSourceCodeToTempFile()' uses 'path.Join' with the attacker-supplied module name, which resolves '../' sequences and allows the resulting path to escape the intended temporary directory. The Dashboard process, running as root, then writes attacker-controlled content to this path using 'os.WriteFile'. This allows for arbitrary file writes within the container filesystem, including sensitive directories like /etc or /usr/local/bin. An attacker can leverage this to achieve code execution or escalate privileges within the Kubernetes namespace using the Dashboard's service account token.

## Affected products

- Nuclio Nuclio <= 1.15.27

## Identifiers

- CVE-2026-52832
- GHSA-wpcj-rmv4-86qg
- GO-2026-6012

## Timeline

- 2026-05-17: disclosed: Vulnerability verified by researcher
- 2026-06-05: advisory: GitHub Advisory published
- 2026-07-16: advisory: CVE-2026-52832 published
- 1.16.5: patched

## References

- [https://api.github.com/users/j311yl0v3u](https://api.github.com/users/j311yl0v3u)
- [https://github.com/j311yl0v3u](https://github.com/j311yl0v3u)
- [https://api.github.com/users/j311yl0v3u/gists%7B/gist_id%7D](https://api.github.com/users/j311yl0v3u/gists%7B/gist_id%7D)
- [https://api.github.com/users/j311yl0v3u/repos](https://api.github.com/users/j311yl0v3u/repos)
- [https://avatars.githubusercontent.com/u/102125416?v=4](https://avatars.githubusercontent.com/u/102125416?v=4)
- [https://api.github.com/users/j311yl0v3u/events%7B/privacy%7D](https://api.github.com/users/j311yl0v3u/events%7B/privacy%7D)

## Related threats

- [Nuclio OS command injection in dashboard namespace validation](https://junglewise.ai/threats/cve-2026-79756-nuclio-os-command-injection-in-dashboard-namespace-validation)
- [Nuclio command injection in Docker platform via namespace filter](https://junglewise.ai/threats/cve-2026-79755-nuclio-command-injection-in-docker-platform-via-namespace-filter)
- [Nuclio Dashboard command injection in Kaniko builder](https://junglewise.ai/threats/cve-2026-79754-nuclio-dashboard-command-injection-in-kaniko-builder)
- [Nuclio code injection in Java runtime build.gradle](https://junglewise.ai/threats/cve-2026-52833-nuclio-code-injection-in-java-runtime-build-gradle)
- [Nuclio command injection in cron trigger event headers and body](https://junglewise.ai/threats/cve-2026-52831-nuclio-command-injection-in-cron-trigger-event-headers-and-body)