Skip to content
OpenAdvisories

Package · Go

github.com/zarf-dev/zarf

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-40090

    Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

    Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are…

    zarf-dev zarf github.com/zarf-dev/zarf github.com/defenseunicorns/zarf Go
  • High 8.2
    CVE-2026-29064

    Zarf: Symlink targets in archives are not validated against destination directory

    Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directo…

    zarf-dev zarf github.com/zarf-dev/zarf github.com/zarf-dev/zarf/src/pkg/archive Go