The Unarchive function in pkg/utils/zip.go of github.com/fission/fission versions prior to 1.25.0 concatenates archive entry names with the destination directory using filepath.Join but does not verify that the resulting path is confined within the destination directory. This allows a Zip Slip directory traversal attack where malicious zip entries with relative paths can cause files to be written outside the intended extraction directory. An attacker able to control the Package.Spec.Source.URL or Deployment.URL archive can exploit this to write files anywhere the fetcher process has write access, including other tenants' directories or sensitive mounted volumes. The issue is fixed in version 1.25.0 by validating archive entry names to reject absolute paths, parent directory traversals, and symlinks, and by confining all filesystem operations to the destination root using os.Root.

An attacker who can supply a crafted zip archive URL to the fetcher sidecar can cause arbitrary files to be written outside the intended extraction directory. This can lead to unauthorized modification or overwriting of files in other tenants' package directories, mounted secret or config volumes, or even the fetcher's own binaries. The vulnerability does not impact confidentiality directly but has a high impact on integrity. Availability impact is not indicated.

A fix is available in github.com/fission/fission version 1.25.0. Users should upgrade to version 1.25.0 or later to ensure that the Unarchive function properly validates archive entry paths and confines extraction to the destination directory. The fix includes rejecting absolute paths, parent directory traversal, and symlink entries, and enforcing filesystem operations within the destination root. Until upgraded, avoid using untrusted zip archives as sources for the fetcher to prevent exploitation.