Skip to content
Threat Feed

Tag

Package-Inspection

1 brief RSS
high advisory

Zarf Path Traversal Vulnerability via Malicious Package Metadata.Name

Zarf is vulnerable to path traversal due to insufficient sanitization of the Metadata.Name field in package manifests when using the `zarf package inspect sbom` or `zarf package inspect documentation` commands, potentially leading to arbitrary file write.

zarf path-traversal arbitrary-file-write package-inspection linux
3r 1t