CVE-2026-50162mediumCWE-73

CVE-2026-50162: falha de média gravidade em oras-project oras-go

oras-go: file store write outside workingDir via symlink traversal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar oras-go+ Monitorar golang-oras-oras-go

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.4%
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
oras-project · oras-go
CVEs relacionadas — oras-project oras-go

No mesmo produto, das mais perigosas para as menos.

CVE-2026-85731HIGHoras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)EPSS 0.7%CVE-2026-50163HIGHoras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extractionEPSS 0.4%CVE-2026-85732MEDIUMoras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probingEPSS 0.4%CVE-2026-50151HIGHoras-go: credential forwarding via unvalidated Location header in blob uploadEPSS 0.4%CVE-2026-48978LOWoras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensEPSS 0.2%