Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| oras-project | oras-go | < 2.6.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-oras-oras-go | 2.6.2-1 | — |
| Debian 13 | golang-oras-oras-go | No fix yet | — |
| Debian 12 | golang-oras-oras-go | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-oras-oras-go | No fix yet | — |
| Ubuntu 26.04 LTS | golang-oras-oras-go | No fix yet | — |
| Ubuntu 24.04 LTS | golang-oras-oras-go | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | helm3 | 3.21.3-0.1.2.hum1 | RHSA-2026:42241 |
| Red Hat Hardened Images 1 | helm4 | 4.2.3-0.1.2.hum1 | RHSA-2026:42230 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | openSUSE-SU-2026:21551-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-cd-3.2 +1 | 3.2.12-r5 | — |
| Wolfi rolling | argo-cd-3.3 | 3.3.12-r3 | — |
| Wolfi rolling | argo-cd-3.3-compat | 3.3.14-r9 | — |
| Wolfi rolling | argo-cd-3.4 +1 | 3.4.4-r2 | — |
| Wolfi rolling | argocd-image-updater | 1.2.2-r2 | — |
| Wolfi rolling | cert-manager-cmctl | 2.5.0-r9 | — |
| Wolfi rolling | chartmuseum | 0.16.5-r16 | — |
| Wolfi rolling | cilium-cli | 0.19.5-r1 | — |
| Wolfi rolling | cluster-api-helm-controller | 0.6.4-r9 | — |
| Wolfi rolling | conftest | 0.68.2-r5 | — |
| Wolfi rolling | consul-k8s-1.9-cli | 1.9.9-r1 | — |
| Wolfi rolling | eksctl | 0.229.0-r1 | — |
| Wolfi rolling | falcoctl | 0.13.0-r10 | — |
| Wolfi rolling | gatekeeper-3.22-gator | 3.22.2-r7 | — |
| Wolfi rolling | gitness | 3.3.0-r25 | — |
| Wolfi rolling | gogatekeeper | 4.10.0-r2 | — |
| Wolfi rolling | headlamp | 0.43.0-r3 | — |
| Wolfi rolling | helm-3 | 3.22.0-r0 | — |
| Wolfi rolling | helm-mapkubeapis | 0.6.1-r22 | — |
| Wolfi rolling | helm-operator +1 | 1.42.3-r1 | — |
| Wolfi rolling | helm-push | 0.11.1-r17 | — |
| Wolfi rolling | helm-set-status | 0.3.0-r22 | — |
| Wolfi rolling | k8ssandra-client | 0.8.14-r2 | — |
| Wolfi rolling | k9s | 0.51.0-r5 | — |
| Wolfi rolling | kargo | 1.10.8-r2 | — |
| Wolfi rolling | kots | 1.130.6-r2 | — |
| Wolfi rolling | kube-arangodb-1.4 | 1.4.3-r14 | — |
| Wolfi rolling | kubescape | 4.0.10-r3 | — |
| Wolfi rolling | kubescape-operator | 0.2.151-r4 | — |
| Wolfi rolling | kyverno-1.17 | 1.17.2-r35 | — |
| Wolfi rolling | kyverno-1.18 +5 | 1.18.1-r11 | — |
| Wolfi rolling | kyverno-cli-1.17 +4 | 1.17.2-r17 | — |
| Wolfi rolling | kyverno-notation-aws | 1.1-r65 | — |
| Wolfi rolling | linkerd2-cli +4 | 26.6.3-r3 | — |
| Wolfi rolling | linkerd2-debug +1 | 26.9.2-r0 | — |
| Wolfi rolling | manifest-tool | 2.2.2-r6 | — |
| Wolfi rolling | maru | 0.6.0-r18 | — |
| Wolfi rolling | opentofu-1.11 | 1.11.11-r2 | — |
| Wolfi rolling | opentofu-1.12 | 1.12.3-r2 | — |
| Wolfi rolling | opentofu-1.12-compat | 1.12.6-r6 | — |
| Wolfi rolling | oras | 1.3.2-r6 | — |
| Wolfi rolling | rancher-2.13 +1 | 2.13.7-r1 | — |
| Wolfi rolling | rancher-2.14 | 2.14.3-r2 | — |
| Wolfi rolling | rancher-agent-2.14 | 2.14.3-r1 | — |
| Wolfi rolling | rancher-fleet | 0.16.1-r3 | — |
| Wolfi rolling | rancher-fleet-cli +2 | 0.15.4-r2 | — |
| Wolfi rolling | rancher-helm-3 | 3.20.0-r16 | — |
| Wolfi rolling | ratify +4 | 1.4.0-r38 | — |
| Wolfi rolling | ratify-licensechecker-compat | 1.4.5-r4 | — |
| Wolfi rolling | steampipe | 2.4.4-r8 | — |
| Wolfi rolling | teleport-18.6 | 18.6.8-r31 | — |
| Wolfi rolling | trivy | 0.72.0-r2 | — |
| Wolfi rolling | trivy-operator | 0.30.1-r23 | — |
| Wolfi rolling | tw +1 | 0.0.50-r1 | — |
| Wolfi rolling | vcluster +2 | 0.35.1-r3 | — |
| Wolfi rolling | xeol | 0.10.8-r48 | — |
| Wolfi rolling | zarf | 0.80.0-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | oras.land/oras-go/v2 | < 2.6.1 | 2.6.1 | GHSA-8xwf-rjm4-xvhv |
Advisories 5
- RHSA-2026:42241 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42230 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SUSE-SU-2026:23227-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- SUSE-SU-2026:23216-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:21551-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 12, 2026