CVE-2026-50162— oras-go: file store write outside workingDir via symlink traversal
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| oras-project | oras-go | < 2.6.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-50162
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
oras-go: file store write outside workingDir via symlink traversal
Source: CVE Program / CVE List V5
Vulnerability Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Vulnerability Title
oras-project oras-go 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
oras-project oras-go是oras-project组织的一个基于OCI标准的内容分发库软件。 oras-project oras-go 2.6.1之前版本存在输入验证错误漏洞，该漏洞源于resolveWritePath()函数使用词法filepath.Rel检查workingDir且未考虑符号链接遍历，导致当AllowPathTraversalOnWrite=false时允许攻击者通过ocispec.AnnotationTitle控制的blob标题跟随符号链接在workingDir外创建文
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| oras-project | oras-go | < 2.6.1 | - |
II. Public POCs for CVE-2026-50162
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50162
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-50162 (1)
Vendor Advisories for CVE-2026-50162 (1)
Vendor Pages for CVE-2026-50162 (1)
- 🔗 Release v2.6.1 · oras-project/oras-go · GitHubx_refsource_MISC
Same Patch Batch · oras-project · 2026-07-17 · 4 CVEs total
| CVE-2026-50151 | 7.5 HIGH | oras-go: credential forwarding via unvalidated Location header in blob upload |
| CVE-2026-50163 | 7.1 HIGH | oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolut |
| CVE-2026-48978 | oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and re |
IV. Related Vulnerabilities
Same weakness: CWE-73
- CVE-2026-54200
TeamDavid: Local File Inclusion via the form field 'scjob' - CVE-2026-12070
TeamDavid: Arbitrary File Deletion via form field 'scjob' - CVE-2026-19011
TinyAGI agents.ts buildSystemPrompt file inclusion - CVE-2026-19009
TinyAGI Message API Endpoint response.ts collectFiles file i - CVE-2026-15307
Server-side file-write and request forgery via spatial looku
V. Comments for CVE-2026-50162
No comments yet