CVE-2026-29064: lfprojects zarf Path Traversal
Vulnerability summary
CVE-2026-29064 is a high (CVSS 8.2) Path Traversal vulnerability in lfprojects zarf. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 06-03-2026PublishedVulnerability first disclosed.
- 06-03-2026Last modifiedVulnerability information updated.
Description
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or write on the system processing the package. This issue has been patched in version 0.73.1.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.2HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- NVDNIST8.2HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
+0.01 pp
From 0.22% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundZarf
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Github.com/zarf-dev1 product
- zarf≥ 0.54.0, < 0.73.1
Github.com/zarf-dev/zarf/src/pkg1 product
- archive≥ 0.54.0, < 0.73.1
Lfprojects1 product
- zarf≥ 0.54.0, < 0.73.1
Zarf-dev1 product
- zarf≥ 0.54.0, < 0.73.1
4 vendors · 4 products
References
4 links- github.com/zarf-dev/zarf/security/advisories/GHSA-hcm4-6hpj-vghmX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/zarf-dev/zarfPACKAGE