Executive brief
oras-go is a Go library used to manage and extract OCI artifacts (like container images). A vulnerability in how the library handles hardlinks allows a malicious artifact to create links to sensitive files on the user's local system, such as SSH keys or cloud credentials, if they are located in the current working directory. An attacker who convinces a user to pull a specially crafted artifact could read or potentially modify these private local files.
Technical details
A path traversal vulnerability exists in the `ensureLinkPath` function within `content/file/utils.go`. While the function correctly validates that a hardlink target resolves within the extraction base, it returns the original unresolved relative path to the caller. The caller then passes this relative path to `os.Link`, which resolves it against the process's current working directory (CWD) rather than the extraction directory. An attacker can exploit this by crafting a tarball with a `TypeLink` entry where the `Linkname` points to a sensitive file (e.g., `.env`, `.aws/credentials`) relative to the CWD. If the artifact is pulled with the `io.deis.oras.content.unpack` annotation set to true, the library will create a hardlink inside the extraction tree that shares an inode with the sensitive file outside the tree. This allows for arbitrary file read and potential tampering. The issue is fixed in version 2.6.2 by ensuring the path is resolved against the link file's directory before calling `os.Link`.
Affected products
- oras-project oras-go < 2.6.2
Timeline
- 2026-06-11: advisory: GitHub Security Advisory GHSA-fxhp-mv3v-67qp published
- 2026-07-03: patched: Fix merged into v2 branch
- 2026-07-10: other: Release v2.6.2 published
- 2026-07-17: disclosed: CVE-2026-50163 published to NVD