Executive brief
oras-go is a Go library for pulling and pushing OCI container artifacts. When extracting untrusted tar layers marked for unpacking, the library fails to properly validate symlink targets, allowing an attacker to write files anywhere on the system that the pulling process can reach. An attacker can exploit this to achieve remote code execution by overwriting critical files like SSH keys, shell initialization scripts, or system binaries.
Technical details
The vulnerability is a tar-slip (path traversal) flaw in the tar extraction routine (`pushDir` in content/file/file.go). Root causes include: (1) lexical-only symlink validation via `filepath.Join` that does not dereference intermediate symlinks; (2) skipped parent-symlink checks for root-level tar entries due to `filepath.Dir("escape") == "."` short-circuiting the validation loop; (3) use of `os.OpenFile` without `O_NOFOLLOW`, allowing writes to follow symlinks. An attacker crafts a tar.gz with nested directories, a deep "up" symlink that resolves legitimately to the extraction root, then an "escape" symlink whose lexical path stays in-bounds but whose kernel-resolved target is an absolute path (e.g., `~/.ssh/authorized_keys`), followed by a regular file entry that overwrites the symlink target. The attack requires the descriptor to carry `io.deis.oras.content.unpack=true` in annotations and is reachable via `oras.Copy()` from an untrusted registry. No authentication or pre-existing symlinks are required.
Affected products
- ORAS oras-go <= v2.6.1
Timeline
- 2026-09-17: disclosed: GHSA-m37j-52j7-pjw7 published
- 2026: other: CVE-2026-85731 assigned