https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T08:48:09.564392+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326521 EUVD-2026-326521 2026-10-09T08:48:09.613977+00:00 EUVD-2026-326521 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50567 fkie_cve-2026-50567 2026-10-09T08:48:09.614022+00:00

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control a Package.Spec.Source.URL or Deployment.URL archive could induce the fetcher (running as the per-environment pod's fission-fetcher sidecar) to write files anywhere that process could reach: into other tenants' /packages/<ns>/ directories, into mounted secret/config volumes, or into the fetcher's own binary. This issue has been patched in version 1.25.0.

 https://cve.radiocsirt.org/vuln/ghsa-q6vm-xqc9-v3ff GHSA-q6vm-xqc9-v3ff — Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory 2026-10-09T08:48:09.614081+00:00

Affected: Go: github.com/fission/fission

`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named `../../tmp/evil` therefore landed at `/tmp/evil`. An attacker who could control a `Package.Spec.Source.URL` or `Deployment.URL` archive could induce the fetcher (running as the per-environment pod's `fission-fetcher` sidecar) to write files anywhere that process could reach: into other tenants' `/packages/<ns>/` directories, into mounted secret/config volumes, or into the fetcher's own binary.

### Affected

- Project: `github.com/fission/fission` - Versions: all up to and including v1.24.0 - Audited commit: `647c141` - Component: `pkg/utils/zip.go` (`Unarchive`) - Configuration: default; triggered when the fetcher downloads and extracts a zip archive

Fix section (paste into the Fix / Patches field)

Fixed in [v1.25.0](https://github.com/fission/fission/releases/tag/v1.25.0) by:

- [PR #3444](https://github.com/fission/fission/pull/3444) (commit [`55704aca`](https://github.com/fission/fission/commit/55704aca1b8d6f45bc7c7c2e4805c7e14875ec0f)) — `Unarchive` now opens an `os.Root` on the destination, validates each archive entry name (rejects absolute paths and `..` traversal), and refuses symlink entries up front. The `os.Root` confines every `mkdir` / `create` to the destination in the kernel.

Regression coverage: `TestUnarc…