Path traversal in oras-project oras-go
Priority MEDIUM 64CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00403 34th percentileScored 2026-11-07
Fix Partial oras-go (oras-project): 2.6.2oras.land/oras-go/v2 (Go): 2.6.2Red Hat: 2 advisoriesRed Hat: 2 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| oras-project | oras-go | before 2.6.2 | 2.6.2 | Patch available | CNA |
| — | oras.land/oras-go/v2 (Go) | before 2.6.2 | 2.6.2 | Patch available | GHSA-fxhp-mv3v-67qp |
- oras-go Vendororas-project Affected before 2.6.2 Fixed in 2.6.2 Patch available CNA
- oras.land/oras-go/v2 (Go) Vendor— Affected before 2.6.2 Fixed in 2.6.2 Patch available GHSA-fxhp-mv3v-67qp
Remediation
- Fix · CNA oras-go (oras-project) Fixed in 2.6.2
- Fix · GHSA-fxhp-mv3v-67qp oras.land/oras-go/v2 (Go) Fixed in 2.6.2 Advisory →
Red Hat 2 advisories
- RHSA-2026:48913 Released 2026-07-30 · Red Hat rating ImportantRHACS 4.10.6 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator
- RHSA-2026:48872 Released 2026-07-30 · Red Hat rating ImportantRHACS 4.9.10 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:48872 |
| Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | Fixed | RHSA-2026:48913 |
Not affected: 2 products
- Red Hat Advanced Cluster Security 4.9
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50163
- 2026-10-03 Alias added: GHSA-fxhp-mv3v-67qp
- 2026-11-06 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
References
Other 6
- https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp
- https://github.com/oras-project/oras-go/pull/1232
- https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451
- https://github.com/oras-project/oras-go/releases/tag/v2.6.2
- https://github.com/oras-project/oras-go/commit/b11f777f8d405c5023c4b307cfdc5068dfc3d406
- https://github.com/oras-project/oras-go
More oras-project vulnerabilities
- TI-2026-58829 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) CVSS 3.1HIGH 8.8
- TI-2026-36926 oras-go: file store write outside workingDir via symlink traversal CVSS 4.0MEDIUM 6.9
- TI-2026-58830 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing CVSS 3.1MEDIUM 4.7
- TI-2026-40126 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption CVSS 3.1MEDIUM 6.5
- TI-2026-36234 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens CVSS 4.0LOW 2.1
Sources
- CVE-2026-50163 · CVE Program
- CVE-2026-50163 · NVD
- FIRST EPSS
- GHSA-fxhp-mv3v-67qp · GitHub Advisory Database · CC BY 4.0
- CVE-2026-50163 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences