Vulnerability · Published Apr 14, 2026 · Assigned by GitHub_M
CVE-2026-40090Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
High 7.1
In plain English
A high-severity path traversal in zarf from zarf-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a user-controlled output directory with the package's Metadata.Name field read directly from the untrusted package's zarf.yaml manifest. Although Metadata.Name is validated against a regex on package creation, an attacker can unarchive a package to modify the Metadata.Name field to contain path traversal sequences such as ../../etc/cron.d/malicious or absolute paths like /home/user/.ssh/authorized_keys, along with the corresponding files inside SBOMS.tar. This allows writing attacker-controlled content to arbitrary filesystem locations within the permissions of the user running the inspect command. This issue has been fixed in version 0.74.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/defenseunicorns/zarf | no fix listed | GO-2026-5542 |
| Go | github.com/zarf-dev/zarf | 0.74.2 | GHSA-pj97-4p9w-gx3q |
| Go | github.com/zarf-dev/zarf | 0.74.2 | GO-2026-5542 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
References
- https://github.com/zarf-dev/zarf/security/advisories/GHSA-pj97-4p9w-gx3q x_refsource_CONFIRM
- https://github.com/zarf-dev/zarf/pull/4793 x_refsource_MISC