CVE-2026-50163

Name of the Vulnerable Software and Affected Versions oras-go versions prior to 2.6.2

Description A path traversal issue exists in the tar-extraction helper function ensureLinkPath() within content/file/utils.go. The function validates that a hardlink target resolves inside the extraction base but returns the original unresolved target string. When os.Link() is called with a relative path, it resolves the target against the process current working directory (CWD) rather than the intended extraction directory.

An attacker controlling an OCI-compliant registry can craft a malicious tarball with a TypeLink entry and a relative Linkname (e.g., victim.secret). If the layer is marked with io.deis.oras.content.unpack: "true", the extraction process creates a hardlink inside the extract tree that shares an inode with a file in the invoker's CWD. This allows an attacker to read sensitive files such as .env, .git/config, .aws/credentials, and ~/.ssh/config if the process is run by a regular user, or any file on the host filesystem if the process is run as root.

Additionally, because the hardlink and the CWD file share an inode, any modifications made to the file within the extract tree will also modify the original file in the CWD.

Recommendations Update oras-go to version 2.6.2. As a temporary mitigation, restrict the use of the io.deis.oras.content.unpack annotation to trusted sources only.