CVE-2026-50163
Received Received - Intake

Path Traversal in oras-go Library

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-18
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-50163

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in oras-go before 2.6.2 involves improper validation of hardlink targets during OCI artifact extraction. The function ensureLinkPath incorrectly returns an unresolved target path, causing the system to resolve hardlinks against the current working directory instead of the intended base directory. This allows attackers to manipulate file paths to access or tamper with sensitive files like .env, .git/config, or .aws/credentials.

Detection Guidance

This vulnerability involves improper handling of hardlink targets in oras-go versions prior to 2.6.2. Detection requires checking for vulnerable versions of oras-go in your Go dependencies. Use commands like 'go list -m all' to list dependencies and verify versions. Look for any usage of oras-go with version < 2.6.2.

Impact Analysis

If you use oras-go versions before 2.6.2 to unpack OCI artifacts with hardlinks enabled, an attacker could craft malicious artifacts that expose or overwrite sensitive files on your system. This could lead to data leaks, configuration tampering, or unauthorized access to credentials and keys.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files such as .env, .aws/credentials, or ~/.ssh/config, which may contain personal data or credentials. For GDPR, this could result in unauthorized processing of personal data. For HIPAA, exposure of .aws/credentials or other config files might compromise protected health information systems.

Mitigation Strategies

Upgrade oras-go to version 2.6.2 or later immediately. If using Go modules, run 'go get -u github.com/oras-project/oras-go/v2@latest'. Review and rebuild any applications using oras-go to ensure they use the patched version. Disable unpacking of OCI artifacts if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50163. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart