CVE-2026-29064
Zarf: Symlink targets in archives are not validated against destination directory
概要
Zarf: Symlink targets in archives are not validated against destination directory
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or write on the system processing the package. This issue has been patched in version 0.73.1.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com