Vulnerability · Published Mar 6, 2026 · Assigned by GitHub_M
CVE-2026-29064Zarf: Symlink targets in archives are not validated against destination directory
High 8.2
In plain English
A high-severity path traversal in zarf from zarf-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or write on the system processing the package. This issue has been patched in version 0.73.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/zarf-dev/zarf | 0.73.1 | GO-2026-4636 |
| Go | github.com/zarf-dev/zarf/src/pkg/archive | 0.73.1 | GHSA-hcm4-6hpj-vghm |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/zarf-dev/zarf/security/advisories/GHSA-hcm4-6hpj-vghm x_refsource_CONFIRM
- https://github.com/zarf-dev/zarf/releases/tag/v0.73.1 x_refsource_MISC