zarf-dev vulnerabilities and threats

Zarf versions 0.23.0 through 0.74.1 contain a path traversal vulnerability in the 'zarf package inspect sbom' and 'zarf package inspect documentation' subcommands. These subcommands construct output file paths by joining a user-controlled output directory with the package's Metadata. Name field, which can be manipulated by an attacker after unarchiving a package. This allows writing arbitrary files to locations on the filesystem accessible by the user running the command. The vulnerability is fixed in version 0.74.

Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or write on the system processing the package. This issue has been patched in version 0.73.1.