---
id: "CVE-2026-85731"
kind: "vulnerability"
aliases: ["CVE-2026-85731", "GHSA-m37j-52j7-pjw7", "GO-2026-6499"]
title: "Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go"
severity: "high"
cvss: 8.8
epss: 0.00676
exploited: false
status: "open"
category: "package"
products: [{"name": "oras.land/oras-go/v2", "fixed": ["2.6.2"], "affected": "< 2.6.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "oci-artifacts", "oras-go", "package"]
not_affected_if: ["no-file-store-unpack", "trusted-registry-only"]
published_at: "2026-09-16T17:18:15+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:44:00+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6499", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-85731", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85731", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

oras-go's file.Store can be tricked by a malicious OCI artifact with a symlink chain into writing a regular file to an attacker-chosen absolute path outside the store root. An attacker who gets a victim to pull such an artifact can overwrite any file the process can write, which may lead to code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:oras.land/oras-go/v2 affected < 2.6.2 fixed 2.6.2

## How to check

Run: go list -m oras.land/oras-go/v2 and confirm the version is 2.6.2 or later. Check go.sum for oras.land/oras-go/v2 versions below 2.6.2.

## Fix

Upgrade oras.land/oras-go/v2 to 2.6.2 or later with go get oras.land/oras-go/v2@v2.6.2 and rebuild.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6499
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-85731
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85731

## From the sources

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_