CVE-2026-85731
HighCVSS 8.8Summary
oras-go prior to 2.6.2 allows content/file.Store extraction of OCI layers marked io.deis.oras.content.unpack=true to write outside the store working directory. A malicious archive can create a symlink chain whose resolved target is an attacker-selected absolute path and overwrite it, even when AllowPathTraversalOnWrite is false.
Risk Assessment
Pulling an attacker-controlled artifact can create or overwrite any file writable by the process, potentially leading to code execution. The risk is high in systems processing untrusted OCI artifacts.
Recommendation
Upgrade oras-go to version 2.6.2 or later. Avoid processing untrusted OCI artifacts until the fix is deployed.
Other vulnerabilities in oras-go
See all- CVE-2026-85732Medium
oras-go before version 2.6.2 does not validate the scheme, host, or port of a URL taken from a registry-controlled Link response header. During pagination operations (Tags, Referrers, Repositories), a GET request is issued to an attacker-selected URL, enabling blind server-side request forgery against internal services.
- GHSA-vh4v-2xq2-g5cgMedium
The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.
- CVE-2026-50163High
Vulnerability in oras-go library (versions prior to 2.6.2) allows an attacker to use hard links to read or modify files outside the extraction directory, such as .env, .git/config, .aws/credentials, and ~/.ssh/config.
- CVE-2026-50162Medium
oras-go before version 2.6.1 has a vulnerability in resolveWritePath() that does not account for symlink traversal. This allows an attacker to bypass AllowPathTraversalOnWrite=false and write files outside the working directory via a controlled blob title.
- CVE-2026-50151High
Vulnerability in the oras-go Go library for managing OCI artifacts. During monolithic blob upload, the client follows a registry-controlled Location header and reuses the Authorization header, allowing a malicious registry to redirect and steal credentials.
- CVE-2026-48978Low
Vulnerability in oras-go library before version 2.6.1. The auth client follows the realm URL from a registry without validation, enabling SSRF attacks to internal networks such as http://169.254.169.254/.
Original NVD description (English source)
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS