Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M
CVE-2026-85731oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
High 8.8
In plain English
A high-severity path traversal in oras-go from oras-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-oras-oras-go | no fix listed | DEBIAN-CVE-2026-85731 |
| Debian:13 | golang-oras-oras-go | no fix listed | DEBIAN-CVE-2026-85731 |
| Debian:14 | golang-oras-oras-go | 2.6.2-1 | DEBIAN-CVE-2026-85731 |
| Go | oras.land/oras-go/v2 | 2.6.2 | GO-2026-6499 |
| Go | oras.land/oras-go/v2 | 2.6.2 | GHSA-m37j-52j7-pjw7 |
| Ubuntu:24.04:LTS | golang-oras-oras-go | no fix listed | UBUNTU-CVE-2026-85731 |
| Ubuntu:26.04:LTS | golang-oras-oras-go | no fix listed | UBUNTU-CVE-2026-85731 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| oras-project | oras-go | < 2.6.2 |
Weakness: CWE-22, CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H