🛡️ CVE-2026-52832 — nuclio

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Summary

Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion.

During function build, writeFunctionSourceCodeToTempFile() passes the module name directly to path.Join(tempDir, moduleFileName). Go's path.Join internally calls path.Clean, which resolves ../ sequences and allows the resolved path to escape tempDir. The function then calls os.WriteFile at the attacker-controlled path with attacker-controlled content (base64-decoded spec.build.functionSourceCode).

The write executes in the Dashboard container process running as uid=0 (root), allowing writes to any filesystem location the process can access: /tmp, /etc, /usr/local/bin, /etc/cron.d, and more.

• CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N — 7.5 (High)
• CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
• Affected versions: Nuclio <= 1.15.27 (latest at time of research, dynamically verified)

Details

Root Cause

The vulnerability spans three functions. The path from user input to disk write is:

1. ParseHandler — no path validation (pkg/functionconfig/handler.go:25-38):

```go

// pkg/functionconfig/handler.go:25-38

func ParseHandler(handler string) (string, string, error) {

moduleAndEntrypoint := strings.Split(handler, ":")

switch len(moduleAndEntrypoint) {

case 1:

return "", moduleAndEntrypoint[0], nil

case 2:

// Returns moduleFileName verbatim — no path sanitization

return moduleAndEntrypoint[0], moduleAndEntrypoint[1], nil

default:

return "", "", errors.Errorf("Invalid handler name %s", handler)

}

}

```

Input "../../../../tmp/vul007_proof.txt:handler" returns moduleFileName = "../../../../tmp/vul007_proof.txt".

2. writeFunctionSourceCodeToTempFile — unsafe path construction (pkg/processor/build/builder.go:613-661):

```go

// builder.go:624-657 (abridged)

tempDir, err := b.mkDirUnderTemp("source")

// tempDir = /tmp/nuclio-build-<random>/source

runtimeExtension, err := b.getRuntimeFileExtensionByName(b.options.FunctionConfig.Spec.Runtime)

moduleFileName, entrypoint, err := functionconfig.ParseHandler(b.options.FunctionConfig.Spec.Handler)

// moduleFileName = "../../../../tmp/vul007_proof.txt" — attacker-controlled

if !strings.Contains(moduleFileName, ".") {

moduleFileName = fmt.Sprintf("%s.%s", moduleFileName, runtimeExtension)

}

// If moduleFileName already contains ".", no extension is appended

// "../../../../tmp/vul007_proof.txt" contains "." -> stays as-is

sourceFilePath := path.Join(tempDir, moduleFileName)

// path.Join("/tmp/nuclio-build-227825660/source", "../../../../tmp/vul007_proof.txt")

// = "/tmp/vul007_proof.txt" <-- escaped tempDir

b.logger.DebugWith("Writing function source code to temporary file", "functionPath", sourceFilePath)

if err := os.WriteFile(sourceFilePath, decodedFunctionSourceCode, os.FileMode(0644)); err != nil {

// Writes attacker-controlled bytes to attacker-controlled path

```

3. cleanupTempDir does not remove the traversal file (builder.go:1047-1061):

```go

// builder.go:1053

err := os.RemoveAll(b.tempDir)

// Only removes /tmp/nuclio-build-<random>/ — traversal file outside this tree persists

```

Path Traversal Calculation

```

tempDir = /tmp/nuclio-build-227825660/source (depth from /: 3 components)

handler = "../../../../tmp/vul007_proof.txt:handler"

module = "../../../../tmp/vul007_proof.txt"

path.Join("/tmp/nuclio-build-227825660/source", "../../../../tmp/vul007_proof.txt")

= path.Clean("/tmp/nuclio-build-227825660/source/../../../../tmp/vul007_proof.txt")

Traversal:

/tmp/nuclio-build-227825660/source (start)

../ -> /tmp/nuclio-build-227825660

../ -> /tmp

../ -> / (filesystem root)

../ -> / (cannot go above root)

tmp/vul007_proof.txt -> /tmp/vul007_proof.txt

```

The same technique with 4x ../ reaches any path under /tmp, /etc, /usr, etc.

Full Attack Chain

```

Unauthenticated HTTP client

-> POST /api/functions (no auth, NOP mode)

dashboard/resource/function.go:156 storeAndDeployFunction()

-> platform.CreateFunction()

platform/kube/platform.go:193

-> abstract/platform.go:191 HandleDeployFunction()

-> abstract/platform.go:119 CreateFunctionBuild()

-> builder.Build()

processor/build/builder.go:195

-> builder.resolveFunctionPath()

builder.go:664

-> builder.writeFunctionSourceCodeToTempFile() <-- file write here

builder.go:613

-> os.WriteFile(attacker_path, attacker_content, 0644)

builder.go:657

```

PoC — Steps to Reproduce

Environment Setup

The following steps set up an isolated kind