Fission EUVD-2026-36072

Exploitation requires local access to the Kubernetes cluster (AV:L) with at least low-privilege tenant credentials (PR:L). The high attack complexity (AC:H) reflects two specific prerequisites: first, the attacker must be able to pre-create or otherwise control a sibling directory on the shared volume whose name begins with the exact string prefix of the fetcher or builder's configured safe directory path; second, the attacker must be able to submit crafted filename values to the builder's Handler or Clean endpoint, or the fetcher's Fetch, Upload, or SpecializeHandler endpoint. Exploitation is limited to the confidentiality and integrity of files accessible within the shared volume scope - it does not grant code execution or cluster-wide privilege escalation. Deployments where tenant workloads are fully isolated from the shared builder/fetcher volume, or where tenants cannot create arbitrary directories on that volume, are not exploitable in practice.

The CVSS 3.1 base score of 3.6 (Low) accurately reflects limited real-world risk. The attack vector is local (AV:L), attack complexity is high (AC:H), and privileges required are low (PR:L), meaning an attacker must already have tenant-level access within the same Kubernetes cluster and must also be able to pre-create or influence a sibling directory on the shared volume whose name begins with the safe directory's prefix. Scope is unchanged (S:U), and confidentiality and integrity impacts are both Low (C:L/I:L/A:N). No EPSS score was provided in the intelligence data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified, reinforcing the low-priority classification. The high attack complexity signal is consistent with the description's requirement for pre-condition control over a specific shared volume path. This is a genuine but narrowly scoped issue: multi-tenant Fission deployments where tenants can influence shared volume layout are the realistic threat model; single-tenant or tightly controlled environments face negligible risk.

A malicious tenant on a shared Fission deployment creates a directory named /fission-packages-evil (sharing the /fission-packages prefix with the legitimate safe directory) on the shared volume, then submits a build or fetch request with a crafted SrcPkgFilename such as ../fission-packages-evil/payload. The legacy SanitizeFilePath call resolves and accepts this path because strings.HasPrefix passes, allowing the builder's Clean handler or the fetcher's Fetch handler to read from or write to the attacker-controlled sibling directory outside the intended safe boundary. No public proof-of-concept code has been identified at time of analysis.