HIGH7.1Go
GHSA-pj97-4p9w-gx3q· CVE-2026-40090, GO-2026-5542Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
Modified: 7/23/2026
package
pkg:go/github.com/zarf-dev/zarf
Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
Modified: 7/23/2026
Zarf's symlink targets in archives are not validated against destination directory in github.com/zarf-dev/zarf
Modified: 3/23/2026
Path traversal via malicious package name in github.com/zarf-dev/zarf
Modified: 7/23/2026