CVE-2026-50162: oras-project oras-go path traversal via symlink in resolveWritePath

CVE-2026-50162 · Severity: medium · CVSS 4 · Published 2026-07-17

oras-go is a software library used to manage and store cloud-native artifacts (like container images). A security flaw allows an attacker to bypass directory restrictions and write files to unauthorized locations on the server's filesystem. This occurs when the library fails to properly handle symbolic links, potentially allowing an attacker to overwrite sensitive files or plant malicious data outside of the intended storage folder.

Technologies: oras.land/oras-go/v2 (Go), ORAS Project Oras-Go. Vendors: Go, ORAS Project.

Quick answers

Is CVE-2026-50162 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50162 being exploited in the wild.
How severe is CVE-2026-50162?
Medium severity, with a CVSS score of 4, published 17 July 2026.
Which products and versions are affected?
oras.land/oras-go/v2 (Go) < 2.6.1, SEMVER:introduced=0,fixed=2.6.1; ORAS Project Oras-Go < 2.6.1.
Is there a fix for CVE-2026-50162?
Yes. oras.land/oras-go/v2 (Go): upgrade to 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50162 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50162?
Check whether you run oras.land/oras-go/v2 (Go) or ORAS Project Oras-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • oras.land/oras-go/v2 (Go): upgrade to 2.6.1 or later
    go get oras.land/oras-go/v2@v2.6.1

Technical details

The vulnerability exists in the `resolveWritePath()` function within `content/file/file.go`. While the library implements a lexical check using `filepath.Rel` to prevent standard `../` directory traversal, it fails to account for symbolic links. If a path component within the `workingDir` is a symlink pointing to an external directory, an attacker can provide a crafted blob title (via `ocispec.AnnotationTitle`) that follows this symlink. Even when `AllowPathTraversalOnWrite` is set to false, the `pushFile()` function will follow the symlink and create files in the external location. This has been fixed in version 2.6.1 by implementing `checkSymlinkEscape`, which resolves symlinks before validating the write boundary.

Affected products

  • oras-project oras-go < 2.6.1

Identifiers

  • CVE-2026-50162
  • GHSA-8xwf-rjm4-xvhv
  • GO-2026-5879

Timeline

  • 2026-06-08: patched: Version 2.6.1 released
  • 2026-06-11: advisory: GitHub Security Advisory published
  • 2026-07-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.