High, CVSS 8.2GoPublished
Zarf's symlink targets in archives are not validated against destination directory
CVE-2026-29064 · GHSA-hcm4-6hpj-vghm
- Affected
- Go github.com/zarf-dev/zarf/src/pkg/archive >= 0.54.0, < 0.73.1
- Fixed in
- 0.73.1· Vendor fix available
- Issue
- A path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or write on the system processing the package. What users should do Upgrade immediately to version v0.73.1 If developers cannot upgrade immediately, only process Zarf packages from fully trusted sources until the fix is applied. If using trusted packages and archives - the only impact to this is updating zarf binary or SDK package versions. Previously created packages do not need to be rebuilt. Who is affected - Any user of affected Zarf versions who processes packages from untrusted or semi-trusted sources. This includes packages received via file transfer, downloaded from registries, or shared across organizational boundaries. This includes use of the zarf tools archiver decompress functionality on generic archives. - Any SDK consumers of Zarf for the affected versions who utilize package…
Recommended action: Upgrade to 0.73.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.