CVE-2026-50162: oras-go Path Traversal Vulnerability

CVE-2026-50162 Overview

CVE-2026-50162 affects oras-go, a Go library for managing Open Container Initiative (OCI) artifacts. Versions prior to 2.6.1 contain a path traversal weakness in resolveWritePath() within content/file/file.go. The function performs a lexical filepath.Rel check against workingDir but does not resolve symbolic links before writing. When AllowPathTraversalOnWrite=false, an attacker-controlled blob title supplied through ocispec.AnnotationTitle (for example, out/pwn.txt) can follow a workingDir symlink such as out -> /some/outside/dir. The result is that pushFile() writes /some/outside/dir/pwn.txt outside the intended working directory. The issue is tracked under [CWE-73] and resolved in version 2.6.1.

Critical Impact
A malicious OCI artifact can cause file writes outside the caller's designated working directory, enabling arbitrary file placement on hosts that pull artifacts with oras-go.

Affected Products

oras-project/oras-go versions prior to 2.6.1
Applications and toolchains embedding oras-go for OCI artifact pulls
CI/CD pipelines that use oras-go to fetch artifacts into working directories containing symlinks

Discovery Timeline

2026-07-17 - CVE-2026-50162 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-50162

Vulnerability Analysis

The defect is a symlink-aware path traversal in the file store write path. resolveWritePath() constructs a target path by joining workingDir with a caller-influenced relative path derived from the artifact's ocispec.AnnotationTitle. The code then calls filepath.Rel(workingDir, target) and rejects results that begin with ../. This check is purely lexical and does not evaluate the on-disk topology of workingDir.

If any intermediate component within workingDir is a symbolic link pointing outside workingDir, the lexical result still looks contained. pushFile() subsequently opens the resolved path through the operating system, which follows the symlink and writes to the external destination. The attacker controls the file name and content by crafting the OCI artifact's title annotation and blob payload.

Root Cause

The root cause is trust in a lexical containment check for a filesystem operation that follows symbolic links. The library set AllowPathTraversalOnWrite=false as a safety default, but the implementation missed the symlink resolution step required to make that guarantee hold.

Attack Vector

Exploitation requires a victim client using oras-go to pull an attacker-supplied OCI artifact into a workingDir that contains a symlink component. The attacker publishes an artifact whose blob descriptor sets ocispec.AnnotationTitle to a path such as out/pwn.txt, where out is a symlink in workingDir pointing to a directory the attacker wishes to write into. When the client resolves and writes the blob, the file lands outside workingDir.

		if strings.HasPrefix(rel, "../") || rel == ".." {
			return "", ErrPathTraversalDisallowed
		}
+		// The lexical check above prevents "../" escapes but does not resolve
+		// symlinks. A symlink component under workingDir (e.g. "out" -> "/outside")
+		// passes the lexical check yet directs writes outside workingDir.
+		// Re-check after resolving symlinks in the parent path to close that gap.
+		if err := checkSymlinkEscape(base, target); err != nil {
+			return "", err
+		}
	}
	if s.DisableOverwrite {
		if _, err := os.Stat(path); err == nil {

Source: GitHub commit cc323e5. The patch adds a checkSymlinkEscape(base, target) call that resolves symlinks in the parent path and rejects targets that escape workingDir.

Detection Methods for CVE-2026-50162

Indicators of Compromise

Files created outside the expected workingDir immediately after an oras pull or oras-go client operation.
OCI artifact manifests containing ocispec.AnnotationTitle values with directory-prefixed paths such as out/, tmp/, or names matching existing symlink components under workingDir.
Unexpected symbolic links present in artifact staging directories on build agents or artifact consumers.

Detection Strategies

Inspect artifact titles at pull time and reject any AnnotationTitle value containing path separators when writing to a shared workingDir.
Scan repositories and build workspaces for symlinks under directories used as oras-go file stores.
Audit dependency manifests (go.mod, go.sum) for oras.land/oras-go versions below 2.6.1.

Monitoring Recommendations

Enable filesystem auditing (auditd, fs.notify, or EDR file-write telemetry) on directories used as OCI artifact staging areas.
Alert on file writes originating from oras or Go binaries where the target path is outside the declared working directory.
Correlate registry pull events with subsequent file-creation events to spot writes that escape their intended sandbox.

How to Mitigate CVE-2026-50162

Immediate Actions Required

Upgrade oras-go to version 2.6.1 or later in all downstream applications and rebuild affected binaries.
Inventory build systems, container tooling, and CI runners that consume OCI artifacts via oras-go and prioritize patching those pulling from untrusted registries.
Remove or refuse to process symlinks inside directories passed as workingDir to the oras-go file store.

Patch Information

The fix is available in oras-go v2.6.1 and detailed in GHSA-8xwf-rjm4-xvhv. The patched resolveWritePath() calls checkSymlinkEscape() after the lexical filepath.Rel check, resolving symlinks in the parent path and rejecting any target that escapes workingDir.

Workarounds

Use a freshly created, symlink-free workingDir for every artifact pull and delete it after use.
Pull artifacts only from trusted registries and validate manifest AnnotationTitle values against an allowlist before writing.
Run artifact-consuming processes under least-privilege accounts with mandatory access controls (SELinux, AppArmor) that constrain write locations.

bash

# Update oras-go to the fixed version
go get oras.land/oras-go/v2@v2.6.1
go mod tidy

# Verify no vulnerable version remains in the dependency graph
go list -m -json all | jq -r 'select(.Path=="oras.land/oras-go/v2") | .Version'

# Optional: audit workingDir for symlinks before pulling
find ./workingDir -type l -ls