CVE-2026-29064 Zarf: Symlink targets in archives are not validated against destination directory
A path traversal flaw in Zarf allows crafted packages to create symlinks outside the destination, enabling arbitrary file read or write.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-29064?
CVE-2026-29064 is a high-severity path traversal vulnerability in zarf-dev zarf, published on 6 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or write on the system processing the package. This issue has been patched in version 0.73.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-29064?
3 open source packages ship an affected version, including github.com/zarf-dev/zarf/src/pkg/archive and github.com/zarf-dev/zarf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zarf-dev/zarf/src/pkg/archive Go | From 0.54.0 | 0.73.1 |
github.com/zarf-dev/zarf/src/pkg/archive Go | From 0.54.0 | 0.73.1 |
github.com/zarf-dev/zarf Go | From 0.54.0 | 0.73.1 |
Products include Lfprojects Zarf.
How do I fix CVE-2026-29064?
Upgrade github.com/zarf-dev/zarf/src/pkg/archive to 0.73.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-29064 being exploited?
There is no known exploitation of CVE-2026-29064 in the wild and no public exploit code.
Other vulnerabilities in zarf-dev zarf
Sources
Also known as GHSA-hcm4-6hpj-vghm, GO-2026-4636.