PT-2026-32968 · Zarf · Zarf

Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-40090

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Zarf versions 0.23.0 through 0.74.1

Description An arbitrary file write issue exists in the 'zarf package inspect sbom' and 'zarf package inspect documentation' subcommands. These subcommands construct output file paths by joining a user-controlled output directory with the Metadata.Name field read from the package's zarf.yaml manifest. An attacker can modify this field to include absolute paths or path traversal sequences, such as '../../etc/cron.d/malicious', allowing them to write attacker-controlled content to arbitrary filesystem locations based on the permissions of the user executing the command.

Recommendations Update to version 0.74.2. Avoid inspecting unsigned packages.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40090

GHSA-PJ97-4P9W-GX3Q

Affected Products

Zarf

References · 7

• https://osv.dev/vulnerability/GHSA-pj97-4p9w-gx3q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40090 · Security Note
• https://github.com/zarf-dev/zarf · Note
• https://github.com/zarf-dev/zarf/pull/4793 · Note
• https://github.com/zarf-dev/zarf/security/advisories/GHSA-pj97-4p9w-gx3q · Note
• https://twitter.com/NewsNerdie/status/2044476404570456224 · Twitter Post
• https://twitter.com/CVEnew/status/2044338862881931424 · Twitter Post