Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

4.9 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS

• CVE-2026-52832: 0.56% estimated exploitation activity in the next 30 days; percentile 46.49 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. During function build, writeFunctionSourceCodeToTempFile() passes the module name directly to path.Join(tempDir, moduleFileName). Go's path.Join internally calls path.Clean, which resolves ../ sequences and allows the resolved path to escape tempDir. The function then calls os.WriteFile at the attacker-controlled path with attacker-controlled content (base64-decoded spec.build.functionSourceCode). The write executes in the Dashboard container process running as uid=0 (root), allowing writes to any filesystem location the process can access: /tmp, /etc, /usr/local/bin, /etc/cron.d, and more. - CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N — 7.5 (High) - CWE: CWE-22 (Improper Limitation of a Pathname to a…

Published by the source

16 Jul 2026, 19:47 UTC

Last modified by the source

16 Jul 2026, 19:47 UTC

Source last checked

26 Oct 2026, 15:25 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-wpcj-rmv4-86qg

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-52832

Advisory: Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
IDs: CVE-2026-52832, GHSA-wpcj-rmv4-86qg
Record: https://patchnext.com/advisories/cve-2026-52832 (revision 1, source checked 26 Oct 2026, 15:25 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 4.9)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/nuclio/nuclio 1.16.5. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/nuclio/nuclio: affected < 1.16.5; fixed in 1.16.5

## Suggested inspection (read-only)
- Go github.com/nuclio/nuclio: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/nuclio/nuclio.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-wpcj-rmv4-86qg (GitHub-reviewed advisory GHSA-wpcj-rmv4-86qg lists affected ranges: Go github.com/nuclio/nuclio >=0 <1.16.5)

Commands are suggestions: review each one before running it.