CVE-2026-50162
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
oras-go before version 2.6.1 has a vulnerability in resolveWritePath() that does not account for symlink traversal. This allows an attacker to bypass AllowPathTraversalOnWrite=false and write files outside the working directory via a controlled blob title.
Risk Assessment
An attacker can write files to arbitrary locations on the server, potentially overwriting critical files or executing malicious code.
Recommendation
Upgrade oras-go to version 2.6.1 or later, which includes the fix.
Other vulnerabilities in oras-go
See all- GHSA-vh4v-2xq2-g5cgMedium
The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.
- CVE-2026-50163High
Vulnerability in oras-go library (versions prior to 2.6.2) allows an attacker to use hard links to read or modify files outside the extraction directory, such as .env, .git/config, .aws/credentials, and ~/.ssh/config.
- CVE-2026-50151High
Vulnerability in the oras-go Go library for managing OCI artifacts. During monolithic blob upload, the client follows a registry-controlled Location header and reuses the Authorization header, allowing a malicious registry to redirect and steal credentials.
- CVE-2026-48978Low
Vulnerability in oras-go library before version 2.6.1. The auth client follows the realm URL from a registry without validation, enabling SSRF attacks to internal networks such as http://169.254.169.254/.
Original NVD description (English source)
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.