CVE-2026-29064 - Vulnerability Analysis

Overview

Zarf 0.54.0 to < 0.73.1 contains a path traversal vulnerability caused by symlink creation during archive extraction, letting attackers read or write arbitrary files on the system processing the package, exploit requires crafted Zarf package.

Severity & Score

Impact

Attackers can read or write arbitrary files on the system processing the package, potentially leading to data tampering or information disclosure.

Mitigation

Update to version 0.73.1 or later.

References

• https://github.com/zarf-dev/zarf/releases/tag/v0.73.1
• https://github.com/zarf-dev/zarf/security/advisories/GHSA-hcm4-6hpj-vghm

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2026-29064 - High (8.2) Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destina... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29064/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner