{"id":"CVE-2026-50163","revision":"8fe4945d4f844689b7d70c605781b4af","records":[{"revision":"8fe4945d4f844689b7d70c605781b4af","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-50163","aliases":[],"title":"oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"<extract_base>/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.","state":0,"publishedAt":"2026-07-17T19:36:01.254+00:00","modifiedAt":"2026-07-20T15:01:16.63+00:00","affected":[{"ecosystem":"Vendor product","name":"oras-go","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"oras-project\",\n                    \"product\": \"oras-go\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.6.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp","https://github.com/oras-project/oras-go/pull/1232","https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-50163","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-50163","identifiers":["CVE-2026-50163"]},"retained":false,"historicalAffected":[]}],"coverage":[]}