Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
Date: 2026-04
Affected: go/github.com/zarf-dev/zarf
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-40090
CWE: CWE-22
CVSS: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L)

### Impact This vulnerability impacts users of `zarf package inspect sbom` or `zarf package inspect documentation` on untrusted packages. ### Patches #4793, now fixed in version v0.74.2 ### Workarounds Avoid inspecting unsigned packages ## Description The `package inspect sbom` and `package inspect documentation` subcommands construct output file paths by joining a user-controlled output directory with the package's `Metadata.Name` field, which is attacker-controlled data read from the package archive. The `Metadata.Name` field is validated against a regex on create, `^[a-z0-9][a-z0-9\-]*$`, however a malicious user could unarchive a package to change the `.Metadata.Name` field and the files inside the SBOMS.tar. This would lead to arbitrary file write in a location of the attackers choosing. Neither location sanitizes or validates the package name before using it in the file path. **SBOM inspection:** ```go outputPath := filepath.Join(o.outputDir, pkgLayout.Pkg.Metadata.Name) err = pkgLayout.GetSBOM(ctx, outputPath) ``` **Documentation inspection (line 1219):** ```go outputPath := filepath.Join(o.outputDir, fmt.Sprintf("%s-documentation", pkgLayout.Pkg.Metadata.Name)) return pkgLayout.GetDocumentation(ctx, outputPath, o.keys) ``` `pkgLayout.Pkg.Metadata.Name` is read directly from the untrusted package's `zarf.yaml` manifest. An attacker can craft a malicious Zarf package where `Metadata.Name` contains path traversal sequences or root paths such as `../../etc/cron.


Mitigations:

Architectural layers (MAESTRO):