Zarf is a Kubernetes package manager with versions 0.23.0 to 0.74.1 vulnerable to CWE-22 path traversal. The vulnerability arises because the output file paths in certain inspect subcommands are constructed by joining a user-controlled output directory with the Metadata.Name field from the package manifest, which can be tampered with after package creation. Despite initial regex validation, an attacker can modify Metadata.Name to include '../' sequences or absolute paths, enabling arbitrary file writes with the privileges of the user running the inspect command. This can lead to overwriting critical files on the host system. The vulnerability is addressed in version 0.74.2.

An attacker who can supply or modify a package can cause the 'zarf package inspect sbom' or 'zarf package inspect documentation' commands to write files to arbitrary locations on the filesystem. This can lead to unauthorized modification of files, potentially enabling further compromise depending on the user's privileges. There is no indication of confidentiality or availability impact beyond the integrity impact of arbitrary file writes. No known exploits in the wild have been reported.

Upgrade to zarf version 0.74.2 or later, where this path traversal vulnerability has been fixed. Until upgrading, avoid running the vulnerable inspect subcommands on untrusted packages or in environments where package contents cannot be fully trusted. Patch status is confirmed fixed in version 0.74.2.