CVE-2026-85731

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.

• CWE-22
• CWE-59

• https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422
• https://github.com/oras-project/oras-go/releases/tag/v2.6.2
• https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7
• https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85720The AsyncHttpClient (AHC) library allows Java applications t…5.9
• CVE-2026-85721The AsyncHttpClient (AHC) library allows Java applications t…7.5
• CVE-2026-85724Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…9.6
• CVE-2026-85725LightRAG provides simple and fast retrieval-augmented genera…5.9
• CVE-2026-8573Integer overflow in Codecs in Google Chrome on Windows prior…8.3
• CVE-2026-85730smol-toml is a small, fast, and correct TOML parser and seri…8.2
• CVE-2026-85732oras-go is a Go library for managing OCI artifacts. Prior to…4.7
• CVE-2026-85734LightRAG provides simple and fast retrieval-augmented genera…9.1
• CVE-2026-85738TREK is a collaborative travel planner. Prior to 3.4.0, the …6.3
• CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to …8.3
• CVE-2026-85740LightRAG provides simple and fast retrieval-augmented genera…7.1
• CVE-2026-8575Use after free in UI in Google Chrome prior to 148.0.7778.16…8.3