CVE-2026-48978

oras-go before version 2.6.2 does not validate the scheme, host, or port of a URL taken from a registry-controlled Link response header. During pagination operations (Tags, Referrers, Repositories), a GET request is issued to an attacker-selected URL, enabling blind server-side request forgery against internal services.

oras-go prior to 2.6.2 allows content/file.Store extraction of OCI layers marked io.deis.oras.content.unpack=true to write outside the store working directory. A malicious archive can create a symlink chain whose resolved target is an attacker-selected absolute path and overwrite it, even when AllowPathTraversalOnWrite is false.

The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.

Vulnerability in oras-go library (versions prior to 2.6.2) allows an attacker to use hard links to read or modify files outside the extraction directory, such as .env, .git/config, .aws/credentials, and ~/.ssh/config.

oras-go before version 2.6.1 has a vulnerability in resolveWritePath() that does not account for symlink traversal. This allows an attacker to bypass AllowPathTraversalOnWrite=false and write files outside the working directory via a controlled blob title.

Vulnerability in the oras-go Go library for managing OCI artifacts. During monolithic blob upload, the client follows a registry-controlled Location header and reuses the Authorization header, allowing a malicious registry to redirect and steal credentials.