CVE-2026-50163: oras-project oras-go path traversal via hardlink resolution

CVE-2026-50163 · Severity: high · CVSS 7.1 · Published 2026-07-17

oras-go is a Go library used to manage and extract OCI artifacts (like container images). A vulnerability in how the library handles hardlinks allows a malicious artifact to create links to sensitive files on the user's local system, such as SSH keys or cloud credentials, if they are located in the current working directory. An attacker who convinces a user to pull a specially crafted artifact could read or potentially modify these private local files.

Technologies: oras.land/oras-go/v2 (Go), ORAS Project Oras-Go. Vendors: Go, ORAS Project.

Quick answers

Is CVE-2026-50163 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50163 being exploited in the wild.
How severe is CVE-2026-50163?
High severity, with a CVSS score of 7.1, published 17 July 2026.
Which products and versions are affected?
oras.land/oras-go/v2 (Go) <= 2.6.1, SEMVER:introduced=0,fixed=2.6.2; ORAS Project Oras-Go < 2.6.2, <= 2.6.1.
Is there a fix for CVE-2026-50163?
Yes. oras.land/oras-go/v2 (Go): upgrade to 2.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50163 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50163?
Check whether you run oras.land/oras-go/v2 (Go) or ORAS Project Oras-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • oras.land/oras-go/v2 (Go): upgrade to 2.6.2 or later
    go get oras.land/oras-go/v2@v2.6.2

Technical details

A path traversal vulnerability exists in the `ensureLinkPath` function within `content/file/utils.go`. While the function correctly validates that a hardlink target resolves within the extraction base, it returns the original unresolved relative path to the caller. The caller then passes this relative path to `os.Link`, which resolves it against the process's current working directory (CWD) rather than the extraction directory. An attacker can exploit this by crafting a tarball with a `TypeLink` entry where the `Linkname` points to a sensitive file (e.g., `.env`, `.aws/credentials`) relative to the CWD. If the artifact is pulled with the `io.deis.oras.content.unpack` annotation set to true, the library will create a hardlink inside the extraction tree that shares an inode with the sensitive file outside the tree. This allows for arbitrary file read and potential tampering. The issue is fixed in version 2.6.2 by ensuring the path is resolved against the link file's directory before calling `os.Link`.

Affected products

  • oras-project oras-go < 2.6.2

Identifiers

  • CVE-2026-50163
  • GHSA-fxhp-mv3v-67qp
  • GO-2026-5880

Timeline

  • 2026-06-11: advisory: GitHub Security Advisory GHSA-fxhp-mv3v-67qp published
  • 2026-07-03: patched: Fix merged into v2 branch
  • 2026-07-10: other: Release v2.6.2 published
  • 2026-07-17: disclosed: CVE-2026-50163 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.