Read the docs
TI-2026-23209 Aliases CVE-2026-29064GHSA-hcm4-6hpj-vghm

Zarf: Symlink targets in archives are not validated against destination directory

Priority LOW 37CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or write on the system processing the package. This issue has been patched in version 0.73.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed zarf (zarf-dev): 0.73.1github.com/zarf-dev/zarf/src/pkg/archive (Go): 0.73.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zarf-devzarf0.54.0 to before 0.73.10.73.1Patch availableCNA
—github.com/zarf-dev/zarf/src/pkg/archive (Go)0.54.0 to before 0.73.10.73.1Patch availableGHSA-hcm4-6hpj-vghm
  • zarf Vendorzarf-dev Affected 0.54.0 to before 0.73.1 Fixed in 0.73.1 Patch available CNA
  • github.com/zarf-dev/zarf/src/pkg/archive (Go) Vendor— Affected 0.54.0 to before 0.73.1 Fixed in 0.73.1 Patch available GHSA-hcm4-6hpj-vghm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:zarf:*:*:*:*:*:*:*:*0.54.0 to before 0.73.1VulnerableMLflow
  • cpe:2.3:a:lfprojects:zarf:*:*:*:*:*:*:*:* Versions 0.54.0 to before 0.73.1 Vulnerable ·MLflow

Remediation

  • Fix · CNA zarf (zarf-dev) Fixed in 0.73.1
  • Fix · GHSA-hcm4-6hpj-vghm github.com/zarf-dev/zarf/src/pkg/archive (Go) Fixed in 0.73.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29064
  2. 2026-10-03 Alias added: GHSA-hcm4-6hpj-vghm

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-28918 Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences