{"id":"CVE-2026-85731","kind":"vulnerability","aliases":["CVE-2026-85731","GHSA-m37j-52j7-pjw7","GO-2026-6499"],"related":[],"title":"Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.","summary":"oras-go's file.Store can be tricked by a malicious OCI artifact with a symlink chain into writing a regular file to an attacker-chosen absolute path outside the store root. An attacker who gets a victim to pull such an artifact can overwrite any file the process can write, which may lead to code execution.","severity":"high","cvss":8.8,"epss":0.00676,"exploited":false,"exploited_at":null,"products":[{"name":"oras.land/oras-go/v2","fixed":["2.6.2"],"affected":"< 2.6.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","oci-artifacts","oras-go","package"],"not_affected_if":["no-file-store-unpack","trusted-registry-only"],"how_to_check":"Run: go list -m oras.land/oras-go/v2 and confirm the version is 2.6.2 or later. Check go.sum for oras.land/oras-go/v2 versions below 2.6.2.","fix":"Upgrade oras.land/oras-go/v2 to 2.6.2 or later with go get oras.land/oras-go/v2@v2.6.2 and rebuild.","status":"open","published_at":"2026-09-16T17:18:15+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:44:00+00:00","updated_at":"2026-10-23T21:44:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:44:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade oras.land/oras-go/v2 to 2.6.2 or later with go get oras.land/oras-go/v2@v2.6.2 and rebuild.","reach":"network","impact":"high","summary":"oras-go's file.Store can be tricked by a malicious OCI artifact with a symlink chain into writing a regular file to an attacker-chosen absolute path outside the store root. An attacker who gets a victim to pull such an artifact can overwrite any file the process can write, which may lead to code execution.","category":"package","who_cares":["go","oras-go","oci-artifacts"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker overwrites any file the process can write, possibly leading to code execution","analyst_note":"","how_to_check":"Run: go list -m oras.land/oras-go/v2 and confirm the version is 2.6.2 or later. Check go.sum for oras.land/oras-go/v2 versions below 2.6.2.","needs_analyst":false,"not_affected_if":["no-file-store-unpack","trusted-registry-only"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000871,"input_tokens":3128,"output_tokens":1117,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':21A,29A,32A '-6499':30A '-85731':22A,33A '/oras-go':19A '/oras-go/v2':36A '2.6.2':116C,241C '52j7':26A 'absolut':72B,193C 'allowpathtraversalonwrit':210C 'arbitrari':1A 'archiv':169C 'artifact':40B,57B,88B,113C,218C 'attack':70B,79B,191C,216C 'attacker-chosen':69B 'attacker-control':215C 'attacker-select':190C 'bypass':11A 'chain':10A,61B,175C 'chosen':71B 'code':101B,233C 'content/file.store':117C 'control':217C 'creat':172C,220C 'cve':20A,31A 'directori':132C 'ensurelinkpath':139C 'entri':155C,207C 'even':208C 'execut':102B,234C 'extract':14A,118C,182C 'extracttardirectori':137C 'fals':212C 'file':2A,66B,92B,166C,206C,224C 'file.store':5A,49B 'fix':238C 'follow':158C 'get':81B 'ghsa':24A 'ghsa-m37j-52j7-pjw7':23A 'go':28A,37B,43B,47B,105C,108C 'insid':180C 'io.deis.oras.content.unpack':124C 'issu':236C 'layer':121C 'lead':99B,231C 'level':154C 'lexic':143C,177C 'librari':109C 'm37j':25A 'malici':55B,168C 'manag':111C 'mark':122C 'may':98B,230C 'name':203C 'oci':39B,56B,112C,120C 'oci-artifact':38B 'open':163C 'ora':42B,46B,104C 'oras-go':41B,45B,103C 'oras.land':18A,35A 'oras.land/oras-go':17A 'oras.land/oras-go/v2':34A 'outsid':4A,74B,128C 'overwrit':90B,196C,222C 'packag':44B 'parent':148C 'parent-symlink':147C 'path':73B,135C,194C 'pjw7':27A 'prior':114C 'process':94B,228C 'pull':85B,213C 'pushdir':15A,134C 'regular':65B,165C,205C 'regular-fil':204C 'remain':179C 'resolv':186C 'resolvereltobas':144C 'root':6A,77B,153C,183C 'root-level':152C 'same-nam':201C 'select':192C 'skip':145C 'store':76B,130C 'symlink':9A,60B,141C,149C,161C,174C 'symlink-chain':8A 'tar':13A 'target':142C,178C,187C,198C 'termin':160C 'therefor':171C 'trick':52B 'true':125C 'valid':140C 'version':240C 'via':7A 'victim':83B 'walk':150C 'whose':176C,185C 'work':131C 'writabl':225C 'write':3A,63B,96B,127C 'writefil':157C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T17:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6499","url":"https://pkg.go.dev/vuln/GO-2026-6499","severity":null,"published_at":"2026-10-01T20:23:52+00:00","modified_at":"2026-10-01T20:23:52+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-85731","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85731","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-85731","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85731","severity":null,"published_at":"2026-09-16T17:18:15+00:00","modified_at":"2026-09-16T18:17:17+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}