This vulnerability arises when Zarf extracts archives from a package. A crafted package can create symbolic links that point to paths outside the intended destination directory. The result is that the system executing the extraction can read or overwrite arbitrary files on the host filesystem, potentially compromising confidentiality, integrity, or availability of critical data.

Zarf (zarf-dev:zarf) is affected in all releases from version 0.54.0 up to, but not including, 0.73.1. The issue is fixed in 0.73.1 and later versions.

The CVSS score is 8.2, indicating high severity. However, the EPSS score is less than 1 %, suggesting that current exploitation likelihood is low. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be local: an attacker who can supply a package to a system running Zarf can trigger the path traversal. Proper version control and package integrity checks would mitigate the risk.