Junglewise Threat Intelligence

ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

Severity: low · CVSS 3.1 · Published 2026-05-19

Vendors: Maven.

Executive brief

ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

Affected products

  • Maven land.oras:oras-java-sdk

Related threats