Skip to content
OpenAdvisories

Package · Go

github.com/zarf-dev/zarf/src/pkg/archive

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.2
    CVE-2026-29064

    Zarf: Symlink targets in archives are not validated against destination directory

    Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directo…

    zarf-dev zarf github.com/zarf-dev/zarf github.com/zarf-dev/zarf/src/pkg/archive Go