Vulnerability · Published Jul 17, 2026 · Assigned by GitHub_M

CVE-2026-50163oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction

High 7.1

In plain English

A high-severity path traversal in oras-go from oras-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 65.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	golang-oras-oras-go	no fix listed	DEBIAN-CVE-2026-50163
Debian:13	golang-oras-oras-go	no fix listed	DEBIAN-CVE-2026-50163
Debian:14	golang-oras-oras-go	2.6.2-1	DEBIAN-CVE-2026-50163
Go	oras.land/oras-go/v2	2.6.2	GHSA-fxhp-mv3v-67qp
Go	oras.land/oras-go/v2	2.6.2	GO-2026-5880
Ubuntu:24.04:LTS	golang-oras-oras-go	no fix listed	UBUNTU-CVE-2026-50163
Ubuntu:26.04:LTS	golang-oras-oras-go	no fix listed	UBUNTU-CVE-2026-50163
Ubuntu:26.10	golang-oras-oras-go	no fix listed	UBUNTU-CVE-2026-50163

Affected products (as reported)

Vendor	Product	Versions
oras-project	oras-go	< 2.6.2

Weakness: CWE-22, CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp x_refsource_CONFIRM
https://github.com/oras-project/oras-go/pull/1232 x_refsource_MISC
https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451 x_refsource_MISC
https://github.com/oras-project/oras-go/releases/tag/v2.6.2 x_refsource_MISC