CVE-2026-85731: oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
oras-goto a version that resolves this vulnerability.Fixed in 2.6.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using oras-go versions earlier than 2.6.2 are exposed when they pull an attacker-controlled OCI artifact whose layers are marked with io.deis.oras.content.unpack=true. The impact is limited by the filesystem permissions of the process performing the extraction.
Does disabling AllowPathTraversalOnWrite prevent exploitation?
No. The described symlink-chain bypass can overwrite an attacker-selected writable path even when AllowPathTraversalOnWrite is false.
What does an attacker need to exploit this?
An attacker needs to cause the application to pull a crafted OCI artifact. Exploitation requires user interaction because the vulnerable extraction occurs when that artifact is pulled, but it does not require attacker privileges.
What should be done if an immediate upgrade is not possible?
Do not pull or unpack untrusted OCI artifacts, particularly artifacts with layers marked for unpacking. Run the pulling process with minimal filesystem permissions to reduce the set of files that could be created or overwritten.
How can I remediate the issue?
Upgrade oras-go to version 2.6.2, which contains the fix.