---
id: CVE-2026-50568
aliases:
  - GHSA-r5jh-q2mw-gcx4
title: >-
  Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory
  escape
summary: >-
  Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory
  escape
severity: low
cvss: 3.6
cwe:
  - CWE-41
vendor: fission
product: github.com/fission/fission
ecosystem: go
affected:
  - github.com/fission/fission <= 1.24.0
patched:
  - github.com/fission/fission 1.25.0
published: '2026-07-28'
updated: '2026-07-28'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-r5jh-q2mw-gcx4'
references:
  - url: 'https://github.com/fission/fission/security/advisories/GHSA-r5jh-q2mw-gcx4'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50568'
  - url: 'https://github.com/fission/fission/pull/3445'
  - url: 'https://github.com/fission/fission/pull/3446'
  - url: >-
      https://github.com/fission/fission/commit/5aac6f0bcdf840e28f3f06c846ca7ae1866b3957
  - url: >-
      https://github.com/fission/fission/commit/8298e33ea7457702f893eae11077987cf905edb4
  - url: 'https://github.com/fission/fission/releases/tag/v1.25.0'
  - url: 'https://github.com/advisories/GHSA-r5jh-q2mw-gcx4'
tags:
  - ghsa
  - go
epss: 0.00138
epssPercentile: 0.02634
ingestedAt: '2026-07-28T20:38:51.009Z'
---

## Overview

`SanitizeFilePath` in `pkg/utils/utils.go` validated that a path stayed under a safe directory by calling `strings.HasPrefix(path, safedir)`. This is a lexical check, not a directory boundary check: `/packages-extra/evil` starts with
`/packages`, so it passed. The function did not enforce a path-separator boundary, so any sibling directory whose name began with the safe-directory string was accepted.

Callers included the builder's `Clean` handler (`pkg/builder/builder.go:208`) and the fetcher's `Fetch` / `Upload` handlers (`pkg/fetcher/fetcher.go`). A tenant who could pre-create or control a sibling directory under the fetcher /
builder's shared volume could induce a write or read outside the intended safe directory.

### Affected

- Project: `github.com/fission/fission`
- Versions: all versions through v1.24.0 with `SanitizeFilePath` in the tree
- Audited commit: `647c141`
- Component: `pkg/utils/utils.go:SanitizeFilePath`
- Callers: `pkg/builder/builder.go:157,164,208`, `pkg/fetcher/fetcher.go:296,311,450,496,565,571`
- Configuration: default; requires a sibling directory to the safe dir to exist on the filesystem


Fix section (paste into the Fix / Patches field)

Fixed in [v1.25.0](https://github.com/fission/fission/releases/tag/v1.25.0) by:

- [PR #3445](https://github.com/fission/fission/pull/3445) (commit [`8298e33e`](https://github.com/fission/fission/commit/8298e33ea7457702f893eae11077987cf905edb4)) — migrate every `SanitizeFilePath` call site (fetcher: `storePath` /
`tmpPath` / `secretDir` / `configDir` / rename + `writeSecretOrConfigMap`; builder: `srcPkg` / `deployPkg` path validation and `srcPkg` stat) to new `pkg/utils/root.go` helpers (`RootJoin`, `RootStat`, `RootWriteFile`, `RootMkdirAll`,
`RootRename`) that operate through `os.Root`. `os.Root` enforces directory confinement in the kernel and is recognized by CodeQL `go/path-injection` as a traversal barrier.
- [PR #3446](https://github.com/fission/fission/pull/3446) (commit [`5aac6f0b`](https://github.com/fission/fission/commit/5aac6f0bcdf840e28f3f06c846ca7ae1866b3957)) — delete the deprecated `SanitizeFilePath` itself once no callers
remained. The vulnerable function no longer exists in the tree.

## Affected packages

- `github.com/fission/fission <= 1.24.0`

## Remediation

Upgrade to a patched release:

- `github.com/fission/fission 1.25.0`