High 7.1Published Jul 17, 2026

CVE-2026-50163oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction

Updated under an hour ago (Oct 26, 2026, 11:40 AM ET)

Does this affect you?

It affects oras-project oras-go. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for oras-project oras-go

Exploited in the last 30 days

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Weakness (CWE): CWE-22, CWE-59
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Jul 20, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

oras-project oras-go oras_project:oras_go (from the name)	before 2.6.2	CNA record

References

https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qpx-refsource-confirm
https://github.com/oras-project/oras-go/pull/1232x-refsource-misc
https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451x-refsource-misc
https://github.com/oras-project/oras-go/releases/tag/v2.6.2x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.