CVE-2026-50162
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
oras-go before version 2.6.1 has a vulnerability in resolveWritePath() that does not account for symlink traversal. This allows an attacker to bypass AllowPathTraversalOnWrite=false and write files outside the working directory via a controlled blob title.
Risk Assessment
An attacker can write files to arbitrary locations on the server, potentially overwriting critical files or executing malicious code.
Recommendation
Upgrade oras-go to version 2.6.1 or later, which includes the fix.
Other vulnerabilities in oras-go
See all- CVE-2026-85732Medium
oras-go before version 2.6.2 does not validate the scheme, host, or port of a URL taken from a registry-controlled Link response header. During pagination operations (Tags, Referrers, Repositories), a GET request is issued to an attacker-selected URL, enabling blind server-side request forgery against internal services.
- CVE-2026-85731High
oras-go prior to 2.6.2 allows content/file.Store extraction of OCI layers marked io.deis.oras.content.unpack=true to write outside the store working directory. A malicious archive can create a symlink chain whose resolved target is an attacker-selected absolute path and overwrite it, even when AllowPathTraversalOnWrite is false.
- GHSA-vh4v-2xq2-g5cgMedium
The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.
- CVE-2026-50163High
Vulnerability in oras-go library (versions prior to 2.6.2) allows an attacker to use hard links to read or modify files outside the extraction directory, such as .env, .git/config, .aws/credentials, and ~/.ssh/config.
- CVE-2026-50151High
Vulnerability in the oras-go Go library for managing OCI artifacts. During monolithic blob upload, the client follows a registry-controlled Location header and reuses the Authorization header, allowing a malicious registry to redirect and steal credentials.
- CVE-2026-48978Low
Vulnerability in oras-go library before version 2.6.1. The auth client follows the realm URL from a registry without validation, enabling SSRF attacks to internal networks such as http://169.254.169.254/.
Original NVD description (English source)
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS