CVE-2026-85731: oras-go Path Traversal Vulnerability

CVE-2026-85731 Overview

CVE-2026-85731 is a path traversal vulnerability in oras-go, a Go library for managing Open Container Initiative (OCI) artifacts. Versions prior to 2.6.2 allow a malicious OCI artifact to write files outside the extraction directory when a layer is marked with io.deis.oras.content.unpack=true. The flaw resides in content/file.Store and enables arbitrary file overwrite even when AllowPathTraversalOnWrite is set to false. Pulling an attacker-controlled artifact can lead to code execution under the identity of the process running the library. The issue is fixed in oras-go v2.6.2 [CWE-22].

Critical Impact
A malicious OCI artifact can overwrite any file writable by the pulling process, potentially resulting in remote code execution on hosts and CI/CD runners that consume untrusted artifacts.

Affected Products

oras-project/oras-go versions prior to 2.6.2
Go applications embedding content/file.Store for OCI artifact extraction
CI/CD pipelines and tooling built on oras-go that pull untrusted OCI artifacts

Discovery Timeline

2026-09-16 - CVE-2026-85731 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85731

Vulnerability Analysis

The vulnerability lives in the tar extraction path used by content/file.Store when unpacking layers marked with the io.deis.oras.content.unpack=true annotation. The pushDir code path calls extractTarDirectory, which relies on ensureLinkPath and resolveRelToBase to constrain symlink targets to the extraction root. These checks validate symlink targets only lexically, and resolveRelToBase skips its parent-symlink walk for root-level entries. As a result, a chain of previously extracted symlinks can point outside the working directory while still appearing contained under lexical analysis.

Root Cause

The root cause is insufficient symlink resolution during tar extraction. writeFile follows a terminal symlink when opening a regular file, so a same-named regular-file entry written after the symlink is placed will follow that symlink to the attacker-selected absolute path. Because containment checks are lexical, they cannot detect that intermediate path components are themselves symlinks pointing outside the extraction root. The AllowPathTraversalOnWrite=false guard does not stop the attack because the write target resolves to a path that passes the lexical containment check.

Attack Vector

An attacker publishes a crafted OCI artifact whose layer manifest carries io.deis.oras.content.unpack=true and includes tar entries that first create a symlink chain, then a regular file with the same name as a link in the chain. When a victim application or CI job pulls and unpacks the artifact using a vulnerable oras-go version, the extractor overwrites an arbitrary absolute path such as ~/.ssh/authorized_keys, /etc/cron.d/, or a binary on $PATH. User interaction is limited to initiating the pull, and no authentication is required against the client library itself.

		}
		filePath := filepath.Join(dirPath, filePathRel)

		// resolveRelToBase only performs lexical and per-component Lstat checks,
		// which a chain of previously-extracted symlinks can bypass. Re-verify
		// containment with symlinks fully resolved before mutating the
		// filesystem, matching the check on the pushFile path.
		// (GHSA-m37j-52j7-pjw7)
		if err := checkSymlinkEscape(dirPath, filePath); err != nil {
			return err
		}

		// Create content
		switch header.Typeflag {
		case tar.TypeReg:

Source: GitHub Commit adab2f2. The patch introduces checkSymlinkEscape, which fully resolves symlinks before any filesystem mutation to enforce containment under dirPath.

Detection Methods for CVE-2026-85731

Indicators of Compromise

OCI artifact manifests containing layers annotated with io.deis.oras.content.unpack=true from untrusted or unexpected registries.
Unexpected file creation or modification outside the configured extraction directory during or immediately after an oras pull.
Symlinks inside pulled artifact directories whose resolved targets fall outside the extraction root (for example, pointing to /etc, /root, /home, or $PATH binaries).
Modifications to sensitive files such as ~/.ssh/authorized_keys, /etc/cron.d/*, systemd unit files, or CI runner configuration coinciding with artifact pulls.

Detection Strategies

Inventory Go binaries and services that import oras.land/oras-go and identify versions below v2.6.2 using go version -m or software composition analysis.
Inspect registry pulls for artifacts declaring the unpack=true layer annotation and flag pulls from non-allowlisted repositories.
Enable audit logging (auditd, Windows file auditing) on directories outside artifact working paths to catch writes originating from oras-based processes.

Monitoring Recommendations

Track process-to-file relationships for CI/CD runners and registry-consuming services, alerting when they modify files outside declared workspaces.
Monitor build agents for new symlinks whose resolved targets exit the working directory tree.
Correlate outbound registry connections with subsequent filesystem changes to sensitive paths for post-pull investigation.

How to Mitigate CVE-2026-85731

Immediate Actions Required

Upgrade all applications and tooling that depend on oras-go to version 2.6.2 or later.
Audit CI/CD pipelines, Kubernetes operators, and internal platforms that pull OCI artifacts using oras-go and rebuild them against the patched library.
Restrict OCI artifact pulls to trusted registries and signed artifacts using policies such as Sigstore/cosign verification.
Run artifact-pulling processes as least-privilege users to reduce the blast radius of arbitrary file writes.

Patch Information

The issue is fixed in oras-gov2.6.2. The fix commit adab2f2 adds a checkSymlinkEscape call that fully resolves symlinks before writing extracted entries, matching the containment check already used on the pushFile path. Details are documented in GitHub Security Advisory GHSA-m37j-52j7-pjw7.

Workarounds

Refuse to pull or unpack OCI layers annotated with io.deis.oras.content.unpack=true from untrusted sources until upgrading is possible.
Extract artifacts inside ephemeral sandboxes, containers, or chroot jails so any arbitrary write remains contained.
Enforce mandatory access control (SELinux, AppArmor) profiles on artifact consumers to block writes outside the intended working directories.

bash

# Update oras-go to the patched release in a Go module
go get oras.land/oras-go/v2@v2.6.2
go mod tidy

# Verify the resolved version
go list -m oras.land/oras-go/v2