Symlink Vulnerability in oras-go Library by ORAS Project

CVE-2026-85731

What is CVE-2026-85731?

The oras-go library, utilized for managing OCI artifacts, contains a vulnerability that allows for the extraction of content or file stores to write outside the designated store working directory. This occurs in versions prior to 2.6.2, where the extraction process validates symlink targets lexically but fails to account for potential malicious manipulation. An attacker can create a symlink chain that appears to point to a safe location while ultimately redirecting to an attacker-chosen absolute path. This enables the overwriting of files that the process can write to, putting systems at risk of unauthorized code execution. The issue has been mitigated in version 2.6.2.

References