Nuclio Dashboard exposes "POST /api/functions" without authentication by default (NOP auth mode). The "spec.handler" field (e.g., "mymodule:myfunction") is parsed by "functionconfig.ParseHandler()" which splits on ":" only — no path validation is applied to the module portion. During function build, "writeFunctionSourceCodeToTempFile()" passes the module name directly to "path.Join(tempDir, moduleFileName)". Go's "path.Join" internally calls "path.Clean", which resolves "../" sequences and allows the resolved path to escape "tempDir". The function then calls "os.WriteFile" at the attacker-controlled path with attacker-controlled content (base64-decoded "spec.build.functionSourceCode"). The write executes in the Dashboard container process running as "uid=0 (root)", allowing writes to any filesystem location the process can access: "/tmp", "/etc", "/usr/local/bin", "/etc/cron.d", and more. - CVSS 3.1: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" — 7.5 (High) - CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) - Affected versions: Nuclio <= 1.15.27 (latest at time of research, dynamically verified) ***