High, CVSS 7.1GoPublished
Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
CVE-2026-40090 · GHSA-pj97-4p9w-gx3q
- Affected
- Go github.com/zarf-dev/zarf >= 0.23.0, < 0.74.2
- Fixed in
- 0.74.2· Vendor fix available
- Issue
- Impact This vulnerability impacts users of zarf package inspect sbom or zarf package inspect documentation on untrusted packages. Patches #4793, now fixed in version v0.74.2 Workarounds Avoid inspecting unsigned packages Description The package inspect sbom and package inspect documentation subcommands construct output file paths by joining a user-controlled output directory with the package's Metadata.Name field, which is attacker-controlled data read from the package archive. The Metadata.Name field is validated against a regex on create, ^[a-z0-9][a-z0-9\-]$, however a malicious user could unarchive a package to change the .Metadata.Name field and the files inside the SBOMS.tar. This would lead to arbitrary file write in a location of the attackers choosing. Neither location sanitizes or validates the package name before using it in the file path. SBOM inspection: Documentation inspection (line 1219): pkgLayout.Pkg.Metadata.Name is read directly from the untrusted package's…
Recommended action: Upgrade to 0.74.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.