oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-85731 · Microsoft / collected KEV context

EUVD-2026-80873

GHSA-m37j-52j7-pjw7

GO-2026-6499

cve-program · CVE-2026-85731

• https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7
• https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422
• https://github.com/oras-project/oras-go/releases/tag/v2.6.2

euvd · EUVD-2026-80873

• https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7
• https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422
• https://github.com/oras-project/oras-go/releases/tag/v2.6.2

nvd · CVE-2026-85731

• https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422
• https://github.com/oras-project/oras-go/releases/tag/v2.6.2
• https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7

osv · GHSA-m37j-52j7-pjw7

• https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7
• https://nvd.nist.gov/vuln/detail/CVE-2026-85731
• https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422
• https://github.com/oras-project/oras-go
• https://github.com/oras-project/oras-go/releases/tag/v2.6.2

osv · GO-2026-6499

• https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7
• https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422
• https://github.com/oras-project/oras-go/releases/tag/v2.6.2

No related operational record is retained in the current change model.