CVE-2026-29064

Zarf (Airgap Native Packager Manager for Kubernetes) is affected by a path traversal vulnerability in archive extraction from versions 0.54.0 up to before 0.73.1. The issue arises because symlink targets are not validated against the destination directory, enabling a package to create symlinks th...

UBUNTU-CVE-2025-4330

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or...