---
id: CVE-2026-50567
aliases:
  - GHSA-q6vm-xqc9-v3ff
title: ' Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory'
summary: ' Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory'
severity: high
cvss: 7.7
cwe:
  - CWE-22
vendor: fission
product: github.com/fission/fission
ecosystem: go
affected:
  - github.com/fission/fission <= 1.24.0
patched:
  - github.com/fission/fission 1.25.0
published: '2026-07-28'
updated: '2026-07-28'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-q6vm-xqc9-v3ff'
references:
  - url: 'https://github.com/fission/fission/security/advisories/GHSA-q6vm-xqc9-v3ff'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50567'
  - url: 'https://github.com/fission/fission/pull/3444'
  - url: 'https://github.com/fission/fission/releases/tag/v1.25.0'
  - url: 'https://github.com/advisories/GHSA-q6vm-xqc9-v3ff'
tags:
  - ghsa
  - go
epss: 0.00447
epssPercentile: 0.36268
ingestedAt: '2026-07-28T20:38:51.038Z'
---

## Overview

`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named
  `../../tmp/evil` therefore landed at `/tmp/evil`. An attacker who could control a `Package.Spec.Source.URL` or `Deployment.URL` archive could induce the fetcher (running as the per-environment pod's `fission-fetcher` sidecar) to write
  files anywhere that process could reach: into other tenants' `/packages/<ns>/` directories, into mounted secret/config volumes, or into the fetcher's own binary.

  ### Affected

  - Project: `github.com/fission/fission`
  - Versions: all up to and including v1.24.0
  - Audited commit: `647c141`
  - Component: `pkg/utils/zip.go` (`Unarchive`)
  - Configuration: default; triggered when the fetcher downloads and extracts a zip archive

  Fix section (paste into the Fix / Patches field)

  Fixed in [v1.25.0](https://github.com/fission/fission/releases/tag/v1.25.0) by:

  - [PR #3444](https://github.com/fission/fission/pull/3444) (commit [`55704aca`](https://github.com/fission/fission/commit/55704aca1b8d6f45bc7c7c2e4805c7e14875ec0f)) — `Unarchive` now opens an `os.Root` on the destination, validates each
  archive entry name (rejects absolute paths and `..` traversal), and refuses symlink entries up front. The `os.Root` confines every `mkdir` / `create` to the destination in the kernel.

  Regression coverage: `TestUnarchiveZipSlip` in `pkg/utils/zip_test.go` exercises parent-traversal, absolute-path, and symlink entries.

## Affected packages

- `github.com/fission/fission <= 1.24.0`

## Remediation

Upgrade to a patched release:

- `github.com/fission/fission 1.25.0`