CVE-2026-29064 - Vulnerability Analysis

Overview

Zarf 0.54.0 to < 0.73.1 contains a path traversal vulnerability caused by symlink creation during archive extraction, letting attackers read or write arbitrary files on the system processing the package, exploit requires crafted Zarf package.

Severity & Score

Impact

Attackers can read or write arbitrary files on the system processing the package, potentially leading to data tampering or information disclosure.

Mitigation

Update to version 0.73.1 or later.

References

• https://github.com/zarf-dev/zarf/releases/tag/v0.73.1
• https://github.com/zarf-dev/zarf/security/advisories/GHSA-hcm4-6hpj-vghm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner