CVE-2026-50162: oras-go has file store write outside workingDir via symlink traversal

July 1, 2026

The file content store in oras-go attempts to confine writes to workingDir when AllowPathTraversalOnWrite=false, but the guard is lexical and does not account for symlink traversal. If workingDir contains a symlink path component and an attacker-controlled blob title (via ocispec.AnnotationTitle) targets a path under that symlink, pushFile() can create a file outside workingDir.

References

github.com/advisories/GHSA-8xwf-rjm4-xvhv
github.com/oras-project/oras-go/commit/cc323e564d90c6b5b4bdd71d3c8d2ee2713b37e5
github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv
nvd.nist.gov/vuln/detail/CVE-2026-50162

Code Behaviors & Features

Detect and mitigate CVE-2026-50162 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →