Vulnerability Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a670
- https://github.com/oras-project/oras-go/releases/tag/v2.6.2
- https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7
- https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7
FAQ
What is CVE-2026-85731?
CVE-2026-85731 is a vulnerability with a CVSS score of 8.8 (HIGH). oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directo...
How severe is CVE-2026-85731?
CVE-2026-85731 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85731?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.