{"cve":"CVE-2026-85731","nvd":{"published":"2026-09-16T17:18:15.833","modified":"2026-09-16T18:17:17.963","status":"Deferred","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-22","CWE-59"],"references":["https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422","https://github.com/oras-project/oras-go/releases/tag/v2.6.2","https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7","https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:54:41.405518556+00:00"},"epss":{"cve":"CVE-2026-85731","score":0.00676,"percentile":0.52244,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-m37j-52j7-pjw7","url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","summary":"oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)","modified":"2026-10-01T20:55:50.398664561Z","packages":[{"ecosystem":"Go","name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ranges":["<2.6.2"],"fixed":["2.6.2"]}]},{"id":"GO-2026-6499","url":"https://osv.dev/vulnerability/GO-2026-6499","summary":"Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go","modified":"2026-10-01T20:45:12.176535928Z","packages":[{"ecosystem":"Go","name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2","ranges":["<2.6.2"],"fixed":["2.6.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}