Live › vulnerability › CVE-2026-85731
Go to dashboardoras-go's file.Store can be tricked by a malicious OCI artifact with a symlink chain into writing a regular file to an attacker-chosen absolute path outside the store root. An attacker who gets a victim to pull such an artifact can overwrite any file the process can write, which may lead to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| oras.land/oras-go/v2 | go | < 2.6.2 | 2.6.2 |
2.6.2 or later2.6.2Upgrade oras.land/oras-go/v2 to 2.6.2 or later with go get oras.land/oras-go/[email protected] and rebuild.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-85731")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.