—
GO-2026-5542
Path traversal via malicious package name in github.com/zarf-dev/zarf
Quick fix
GO-2026-5542 — github.com/zarf-dev/zarf: upgrade to the fixed version with the command below.
go get github.com/zarf-dev/zarf@v0.74.2Details
A path traversal vulnerability in Zarf allows an attacker to write arbitrary files on the host system by providing a malicious package name in the package metadata. This occurs when Zarf generates SBOM or documentation outputs, or when creating a package, as it fails to properly sanitize the package name before using it in a file path.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/defenseunicorns/zarf
Introduced in:
0.23.0 No fixed version published yet for github.com/defenseunicorns/zarf (go modules). Pin to a known-safe version or switch to an alternative.
Go / github.com/zarf-dev/zarf
Introduced in:
0.37.0 Fixed in: 0.74.2 Fix
go get github.com/zarf-dev/zarf@v0.74.2