fkie_cve-2026-52832

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.

GHSA-wpcj-rmv4-86qg — Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Affected: Go: github.com/nuclio/nuclio

## Summary

Nuclio Dashboard exposes `POST /api/functions` without authentication by default (NOP auth mode). The `spec.handler` field (e.g., `mymodule:myfunction`) is parsed by `functionconfig.ParseHandler()` which splits on `:` only — no path validation is applied to the module portion.

During function build, `writeFunctionSourceCodeToTempFile()` passes the module name directly to `path.Join(tempDir, moduleFileName)`. Go's `path.Join` internally calls `path.Clean`, which resolves `../` sequences and allows the resolved path to escape `tempDir`. The function then calls `os.WriteFile` at the attacker-controlled path with attacker-controlled content (base64-decoded `spec.build.functionSourceCode`).

The write executes in the Dashboard container process running as `uid=0 (root)`, allowing writes to any filesystem location the process can access: `/tmp`, `/etc`, `/usr/local/bin`, `/etc/cron.d`, and more.

- **CVSS 3.1**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` — **7.5 (High)** - **CWE**: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) - **Affected versions**: Nuclio <= 1.15.27 (latest at time of research, dynamically verified)

---

## Details

### Root Cause

The vulnerability spans three functions. The path from user input to disk write is:

**1. `ParseHandler` — no path validation** (`pkg/functionconfig/handler.go:25-38`):

```go // pkg/functionconfig/handler.go:25-38 func ParseHandler(handler string) (string, string, error) { moduleAndEntryp…

Most recent entries from all

fkie_cve-2026-52832

GHSA-wpcj-rmv4-86qg — Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container