Detections
Analytics
SCA: security update for github.com/fission/fission (GHSA-r5jh-q2mw-gcx4)
low Tenable Self-Hosted Container Security Plugin ID 445435
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of
functions and applications on Kubernetes. Prior to version 1.25.0, SanitizeFilePath in pkg/utils/utils.go
validated that a path stayed under a safe directory by calling strings.HasPrefix(path, safedir). This is a
lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed.
The function did not enforce a path-separator boundary, so any sibling directory whose name began with the
safe-directory string was accepted. Callers included the builder's Clean handler
(pkg/builder/builder.go:208) and the fetcher's Fetch / Upload handlers (pkg/fetcher/fetcher.go). A tenant
who could pre-create or control a sibling directory under the fetcher / builder's shared volume could
induce a write or read outside the intended safe directory. This issue has been patched in version 1.25.0.
(CVE-2026-50568)
Solution
Update the github.com/fission/fission library and its related packages to version 1.25.0 or later.See Also
Plugin Details
Severity: Low
ID: 445435
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 7/29/2026
Updated: 7/29/2026
Risk Information
VPR
Risk Factor: Low
Score: 2.1
Percentile: 7.75
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.4
Temporal Score: 1.8
Vector: CVSS2#AV:L/AC:H/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2026-50568
CVSS v3
Risk Factor: Low
Base Score: 3.6
Temporal Score: 3.2
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 7/28/2026
Vulnerability Publication Date: 6/10/2026
Reference Information
CVE: CVE-2026-50568
cwe: CWE-41