CVE-2026-85731: oras-go arbitrary file write via symlink-chain bypass in tar extraction

CVE-2026-85731 · Severity: high · CVSS 8.8 · Published 2026-09-16

oras-go is a Go library for pulling and pushing OCI container artifacts. When extracting untrusted tar layers marked for unpacking, the library fails to properly validate symlink targets, allowing an attacker to write files anywhere on the system that the pulling process can reach. An attacker can exploit this to achieve remote code execution by overwriting critical files like SSH keys, shell initialization scripts, or system binaries.

Technologies: oras.land/oras-go/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-85731 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85731 being exploited in the wild.
How severe is CVE-2026-85731?
High severity, with a CVSS score of 8.8, published 16 September 2026.
Which products and versions are affected?
oras.land/oras-go/v2 (Go) <= 2.6.1, SEMVER:introduced=0,fixed=2.6.2.
Is there a fix for CVE-2026-85731?
Yes. oras.land/oras-go/v2 (Go): upgrade to 2.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85731 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-85731?
Check whether you run oras.land/oras-go/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • oras.land/oras-go/v2 (Go): upgrade to 2.6.2 or later
    go get oras.land/oras-go/v2@v2.6.2

Technical details

The vulnerability is a tar-slip (path traversal) flaw in the tar extraction routine (`pushDir` in content/file/file.go). Root causes include: (1) lexical-only symlink validation via `filepath.Join` that does not dereference intermediate symlinks; (2) skipped parent-symlink checks for root-level tar entries due to `filepath.Dir("escape") == "."` short-circuiting the validation loop; (3) use of `os.OpenFile` without `O_NOFOLLOW`, allowing writes to follow symlinks. An attacker crafts a tar.gz with nested directories, a deep "up" symlink that resolves legitimately to the extraction root, then an "escape" symlink whose lexical path stays in-bounds but whose kernel-resolved target is an absolute path (e.g., `~/.ssh/authorized_keys`), followed by a regular file entry that overwrites the symlink target. The attack requires the descriptor to carry `io.deis.oras.content.unpack=true` in annotations and is reachable via `oras.Copy()` from an untrusted registry. No authentication or pre-existing symlinks are required.

Affected products

  • ORAS oras-go <= v2.6.1

Identifiers

  • CVE-2026-85731
  • GHSA-m37j-52j7-pjw7
  • GO-2026-6499

Timeline

  • 2026-09-17: disclosed: GHSA-m37j-52j7-pjw7 published
  • 2026: other: CVE-2026-85731 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.