CVE-2026-50162

Name of the Vulnerable Software and Affected Versions oras-go versions prior to 2.6.1

Description When AllowPathTraversalOnWrite is set to false, the file content store fails to properly confine writes to the workingDir because the boundary check is purely lexical and does not account for symlink traversal. An attacker can provide a malicious blob title via ocispec.AnnotationTitle that targets a path under a symlink within the workingDir. This allows the resolveWritePath() function (used by pushFile()) to bypass the intended restriction and create files outside the designated directory.

Recommendations Update to version 2.6.1. As a temporary mitigation, ensure that the workingDir does not contain any symlinks that point to locations outside the intended directory.