https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 09:05:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326521 EUVD-2026-326521 https://cve.radiocsirt.org/vuln/euvd-2026-326521 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50567 <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control a Package.Spec.Source.URL or Deployment.URL archive could induce the fetcher (running as the per-environment pod&#39;s fission-fetcher sidecar) to write files anywhere that process could reach: into other tenants&#39; /packages/&lt;ns&gt;/ directories, into mounted secret/config volumes, or into the fetcher&#39;s own binary. This issue has been patched in version 1.25.0.</p> <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control a Package.Spec.Source.URL or Deployment.URL archive could induce the fetcher (running as the per-environment pod&#39;s fission-fetcher sidecar) to write files anywhere that process could reach: into other tenants&#39; /packages/&lt;ns&gt;/ directories, into mounted secret/config volumes, or into the fetcher&#39;s own binary. This issue has been patched in version 1.25.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50567 https://cve.radiocsirt.org/vuln/ghsa-q6vm-xqc9-v3ff <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named `../../tmp/evil` therefore landed at `/tmp/evil`. An attacker who could control a `Package.Spec.Source.URL` or `Deployment.URL` archive could induce the fetcher (running as the per-environment pod&#39;s `fission-fetcher` sidecar) to write files anywhere that process could reach: into other tenants&#39; `/packages/&lt;ns&gt;/` directories, into mounted secret/config volumes, or into the fetcher&#39;s own binary.</p> <p>### Affected</p> <p>- Project: `github.com/fission/fission` - Versions: all up to and including v1.24.0 - Audited commit: `647c141` - Component: `pkg/utils/zip.go` (`Unarchive`) - Configuration: default; triggered when the fetcher downloads and extracts a zip archive</p> <p>Fix section (paste into the Fix / Patches field)</p> <p>Fixed in [v1.25.0](https://github.com/fission/fission/releases/tag/v1.25.0) by:</p> <p>- [PR #3444](https://github.com/fission/fission/pull/3444) (commit [`55704aca`](https://github.com/fission/fission/commit/55704aca1b8d6f45bc7c7c2e4805c7e14875ec0f)) — `Unarchive` now opens an `os.Root` on the destination, validates each archive entry name (rejects absolute paths and `..` traversal), and refuses symlink entries up front. The `os.Root` confines every `mkdir` / `create` to the destination in the kernel.</p> <p>Regression coverage: `TestUnarc…</p> <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named `../../tmp/evil` therefore landed at `/tmp/evil`. An attacker who could control a `Package.Spec.Source.URL` or `Deployment.URL` archive could induce the fetcher (running as the per-environment pod&#39;s `fission-fetcher` sidecar) to write files anywhere that process could reach: into other tenants&#39; `/packages/&lt;ns&gt;/` directories, into mounted secret/config volumes, or into the fetcher&#39;s own binary.</p> <p>### Affected</p> <p>- Project: `github.com/fission/fission` - Versions: all up to and including v1.24.0 - Audited commit: `647c141` - Component: `pkg/utils/zip.go` (`Unarchive`) - Configuration: default; triggered when the fetcher downloads and extracts a zip archive</p> <p>Fix section (paste into the Fix / Patches field)</p> <p>Fixed in [v1.25.0](https://github.com/fission/fission/releases/tag/v1.25.0) by:</p> <p>- [PR #3444](https://github.com/fission/fission/pull/3444) (commit [`55704aca`](https://github.com/fission/fission/commit/55704aca1b8d6f45bc7c7c2e4805c7e14875ec0f)) — `Unarchive` now opens an `os.Root` on the destination, validates each archive entry name (rejects absolute paths and `..` traversal), and refuses symlink entries up front. The `os.Root` confines every `mkdir` / `create` to the destination in the kernel.</p> <p>Regression coverage: `TestUnarc…</p> https://cve.radiocsirt.org/vuln/ghsa-q6vm-xqc9-v3ff