High severity · published Jul 17, 2026
CVE-2026-50163
oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
oras-go · oras-project
< 2.6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-50163
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-50163
github.com
https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451
github.com
https://github.com/oras-project/oras-go/pull/1232
github.com
https://github.com/oras-project/oras-go/releases/tag/v2.6.2
github.com
https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp
More from oras-go
8.8
CVE-2026-85731
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
7.5
CVE-2026-50151
oras-go: credential forwarding via unvalidated Location header in blob upload
6.9
CVE-2026-50162
oras-go: file store write outside workingDir via symlink traversal
4.7
CVE-2026-85732
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
2.1
CVE-2026-48978
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens