Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| oras-project | oras-go | < 2.6.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-oras-oras-go | 2.6.2-1 | — |
| Debian 13 | golang-oras-oras-go | No fix yet | — |
| Debian 12 | golang-oras-oras-go | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-oras-oras-go | No fix yet | — |
| Ubuntu 26.04 LTS | golang-oras-oras-go | No fix yet | — |
| Ubuntu 24.04 LTS | golang-oras-oras-go | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
| SLES for SAP 16.0 | helm | 4.3.0-160000.1.1 | SUSE-SU-2026:23984-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
| SLES 16.0 | helm | 4.3.0-160000.1.1 | SUSE-SU-2026:23984-1 |
| SLE Micro 6.2 | helm | 4.3.0-160000.1.1 | SUSE-SU-2026:23973-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | helm | 4.3.0-slfo.1.1_1.1 | SUSE-SU-2026:24282-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | helm | 4.2.4-1.1 | openSUSE-SU-2026:11575-1 |
| openSUSE Tumbleweed | oras | 1.3.3-2.1 | openSUSE-SU-2026:11297-1 |
| openSUSE Tumbleweed | trivy | 0.74.0-2.1 | openSUSE-SU-2026:11676-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | openSUSE-SU-2026:21551-1 |
| openSUSE Leap 16.0 | helm | 4.3.0-160000.1.1 | openSUSE-SU-2026:21983-1 |
| openSUSE Leap 16.0 | trivy | 0.74.0-160000.2.1 | openSUSE-SU-2026:21801-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-cd-3.2 +1 | 3.2.12-r8 | — |
| Wolfi rolling | argo-cd-3.3 +1 | 3.3.12-r7 | — |
| Wolfi rolling | argo-cd-3.4 +1 | 3.4.5-r2 | — |
| Wolfi rolling | argocd-image-updater | 1.3.0-r0 | — |
| Wolfi rolling | cert-manager-cmctl | 2.5.0-r19 | — |
| Wolfi rolling | chartmuseum | 0.16.6-r0 | — |
| Wolfi rolling | cilium-cli | 0.19.7-r1 | — |
| Wolfi rolling | cluster-api-helm-controller | 0.6.4-r20 | — |
| Wolfi rolling | conftest | 0.69.0-r0 | — |
| Wolfi rolling | consul-k8s-1.9-cli | 1.9.10-r0 | — |
| Wolfi rolling | falcoctl | 0.13.0-r23 | — |
| Wolfi rolling | flux-helm-controller | 1.6.4-r3 | — |
| Wolfi rolling | flux-source-controller | 1.9.5-r1 | — |
| Wolfi rolling | gatekeeper-3.22-gator | 3.22.2-r12 | — |
| Wolfi rolling | gitness | 3.3.0-r38 | — |
| Wolfi rolling | gogatekeeper | 4.11.0-r0 | — |
| Wolfi rolling | grafana-operator | 5.25.0-r0 | — |
| Wolfi rolling | headlamp | 0.45.0-r0 | — |
| Wolfi rolling | helm-3 | 3.21.3-r2 | — |
| Wolfi rolling | helm-4 | 4.2.3-r1 | — |
| Wolfi rolling | helm-mapkubeapis | 0.6.1-r33 | — |
| Wolfi rolling | helm-operator | 1.42.3-r10 | — |
| Wolfi rolling | helm-set-status | 0.3.0-r33 | — |
| Wolfi rolling | k8ssandra-client | 0.9.0-r0 | — |
| Wolfi rolling | k9s | 0.51.0-r20 | — |
| Wolfi rolling | kargo +2 | No fix yet | — |
| Wolfi rolling | kots | 1.131.0-r0 | — |
| Wolfi rolling | kube-arangodb-1.4 +1 | 1.4.5-r4 | — |
| Wolfi rolling | kubescape-operator | 0.2.169-r0 | — |
| Wolfi rolling | kyverno-1.17 | 1.17.2-r35 | — |
| Wolfi rolling | kyverno-1.18 +5 | 1.18.2-r12 | — |
| Wolfi rolling | kyverno-cli-1.17 +4 | 1.17.2-r32 | — |
| Wolfi rolling | kyverno-notation-aws | 1.1-r80 | — |
| Wolfi rolling | linkerd2-cli +4 | 26.8.3-r0 | — |
| Wolfi rolling | linkerd2-debug +1 | 26.9.2-r0 | — |
| Wolfi rolling | opa +1 | 1.19.0-r0 | — |
| Wolfi rolling | opentofu-1.12 | 1.12.6-r7 | — |
| Wolfi rolling | oras | 1.3.3-r0 | — |
| Wolfi rolling | rancher-2.13 +1 | 2.13.8-r0 | — |
| Wolfi rolling | rancher-2.14 +1 | 2.14.4-r0 | — |
| Wolfi rolling | rancher-fleet | 0.16.1-r3 | — |
| Wolfi rolling | rancher-fleet-cli +2 | 0.16.0-r0 | — |
| Wolfi rolling | rancher-helm-3 | 3.20.0-r28 | — |
| Wolfi rolling | ratify +4 | 1.4.3-r0 | — |
| Wolfi rolling | steampipe | 2.4.5-r0 | — |
| Wolfi rolling | tigera-operator-1.42 | 1.42.5-r0 | — |
| Wolfi rolling | trivy | 0.74.0-r0 | — |
| Wolfi rolling | trivy-operator | 0.33.0-r0 | — |
| Wolfi rolling | vcluster +2 | 0.37.0-r0 | — |
| Wolfi rolling | xeol | 0.10.8-r62 | — |
| Wolfi rolling | zarf | 0.81.1-r0 | — |
| Wolfi rolling | zot | 2.1.19-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | oras.land/oras-go/v2 | < 2.6.2 | 2.6.2 | GHSA-fxhp-mv3v-67qp |
Advisories 11
- SUSE-SU-2026:24282-1 Security update for helm SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:23984-1 Security update for helm SUSE / openSUSE Security Updates · Oct 6, 2026
- SUSE-SU-2026:23973-1 Security update for helm SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:21983-1 Security update for helm SUSE / openSUSE Security Updates · Oct 1, 2026
- openSUSE-SU-2026:21801-1 Security update for trivy SUSE / openSUSE Security Updates · Sep 10, 2026
- openSUSE-SU-2026:11676-1 trivy-0.74.0-2.1 on GA media SUSE / openSUSE Security Updates · Sep 3, 2026
- SUSE-SU-2026:23227-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- SUSE-SU-2026:23216-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:11575-1 helm-4.2.4-1.1 on GA media SUSE / openSUSE Security Updates · Aug 23, 2026
- openSUSE-SU-2026:21551-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 12, 2026
- openSUSE-SU-2026:11297-1 oras-1.3.3-2.1 on GA media SUSE / openSUSE Security Updates · Jul 18, 2026