Executive brief
oras-go is a software library used to manage and store cloud-native artifacts (like container images). A security flaw allows an attacker to bypass directory restrictions and write files to unauthorized locations on the server's filesystem. This occurs when the library fails to properly handle symbolic links, potentially allowing an attacker to overwrite sensitive files or plant malicious data outside of the intended storage folder.
Technical details
The vulnerability exists in the `resolveWritePath()` function within `content/file/file.go`. While the library implements a lexical check using `filepath.Rel` to prevent standard `../` directory traversal, it fails to account for symbolic links. If a path component within the `workingDir` is a symlink pointing to an external directory, an attacker can provide a crafted blob title (via `ocispec.AnnotationTitle`) that follows this symlink. Even when `AllowPathTraversalOnWrite` is set to false, the `pushFile()` function will follow the symlink and create files in the external location. This has been fixed in version 2.6.1 by implementing `checkSymlinkEscape`, which resolves symlinks before validating the write boundary.
Affected products
- oras-project oras-go < 2.6.1
Timeline
- 2026-06-08: patched: Version 2.6.1 released
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD