zarf vulnerabilities

2 known vulnerabilities in zarf from Zarf-dev. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  zarf: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-40090Apr 15, 2026Zarf-dev

  Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are

• 8.2 High severity

  zarf: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-29064Mar 6, 2026Zarf-dev

  Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination director