Zarf-dev vulnerabilities
We track 2 vulnerabilities in Zarf-dev products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 15, 2026.
2vulnerabilities
0critical
2high
0exploited
7.6average CVSS score
Latest Zarf-dev vulnerabilities
- 7.1 High severity
zarf: Improper Limitation of a Pathname to a Restricted Directory
Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are
- 8.2 High severity
zarf: Improper Limitation of a Pathname to a Restricted Directory
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination director