CVE-2026-50163 Details
Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.
A vulnerability in the Oras-Go library, prior to version 2.6.2, allows for path traversal via hardlink entries in tarball layers. The issue arises because the 'ensureLinkPath' function validates hardlink targets relative to the extraction base but returns the unresolved target. This flaw can be exploited by crafting an OCI artifact that links to a file in the current working directory of the process, potentially exposing sensitive information such as environment variables or configuration files.
Users can update to Oras-Go version 2.6.2, which resolves the vulnerability by properly validating and resolving hardlink targets before extraction.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451 | [email protected] | Source CodeVendor |
| https://github.com/oras-project/oras-go/pull/1232 | [email protected] | Issue TrackingVendor |
| https://github.com/oras-project/oras-go/releases/tag/v2.6.2 | [email protected] | Release NotesVendor |
| https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| oras-project oras-go | <v2.6.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |