Skip to content
Fencer Vulns
medium 6.9

CVE-2026-50162 json

oras-go: file store write outside workingDir via symlink traversal

published 2026-07-01 4 mo ago modified 2026-10-24 15 d ago also EUVD-2026-45262 , GHSA-8xwf-rjm4-xvhv , GO-2026-5879

cvss
6.9
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.

Patch / fix

  • go oras.land/oras-go/v2 2.6.1
  • linuxfoundation oras 2.6.1
  • golang-oras-oras-go Debian 14 2.6.2-1

debian advisories DEBIAN-CVE-2026-50162

  • helm3 hummingbird 1 3.21.3-0.1.2.hum1
  • helm4 hummingbird 1 4.2.3-0.1.2.hum1

red hat advisories RHSA-2026:42241RHSA-2026:42230

  • govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260727T201416-160000.1.1

suse advisories SUSE-SU-2026:23216-1SUSE-SU-2026:23227-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260727T201416-160000.1.1

opensuse advisories openSUSE-SU-2026:21551-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-50162 updated cvss 5.3

oras-go: oras-go: File store write outside working directory via symlink traversal

  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9
    affected: no fix available
  • Red Hat MCP Server for Red Hat OpenShift openshift-mcp-beta/openshift-mcp-server-rhel9, openshift-mcp-tech-preview/openshift-mcp-server-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Lightspeed openshift-lightspeed/openshift-mcp-server-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/multicloud-integrations-rhel9, rhacm2/multicluster-operators-channel-rhel9, rhacm2/multicluster-operators-subscription-rhel9
    affected: no fix available
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-scanner-v4-rhel8
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Ceph Storage 9 rhceph/alloy-rhel10
    affected: no fix available “Fix deferred”
  • Red Hat Developer Hub 1 rhdh/rhdh-must-gather-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4-dev-preview-beta/openperouter-rhel9-operator, openshift4-dev-preview-beta/openperouter-operator-bundle, openshift4-dev-preview-beta/openperouter-edge-rhel10-operator Red Hat OpenShift Container Platform 5 openshift5-dev-preview-beta/openperouter-rhel9-operator, openshift5-dev-preview-beta/openperouter-operator-bundle, openshift5-dev-preview-beta/openperouter-edge-rhel10-operator
    affected: no fix available
  • Red Hat Openshift Data Foundation 4 odf4/odf-multicluster-rhel9-operator
    affected: no fix available “Fix deferred”
show 15 more
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat Trusted Artifact Signer rhtas/ec-rhel9, rhtas/policy-controller-rhel9-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-rhel9-operator, rhtpa/rhtpa-rhel10-operator Red Hat Web Terminal web-terminal/web-terminal-tooling-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat Migration Toolkit for Virtualization 2.10 migration-toolkit-virtualization/mtv-validation-rhel9 1791228247
    fixed: vendor fix RHSA-2026:83663
  • Red Hat Migration Toolkit for Virtualization 2.11 migration-toolkit-virtualization/mtv-validation-rhel9 1791229031
    fixed: vendor fix RHSA-2026:83662
  • Red Hat OpenShift Security Profiles Operator 1 compliance/openshift-security-profiles-rhel8-operator 1790623030, compliance/openshift-security-profiles-operator-bundle 1790626888
    fixed: vendor fix RHSA-2026:76752
  • Red Hat Edge Manager 1.1 rhem/flightctl-api-rhel9 1789487080, rhem/flightctl-api-rhel10 1789485939, rhem/flightctl-worker-rhel9 1789486829, rhem/flightctl-worker-rhel10 1789486071, rhem/flightctl-db-setup-rhel9 1789487116, rhem/flightctl-periodic-rhel9 1789486513, +18 more
    fixed: vendor fix RHSA-2026:68044
  • Red Hat Edge Manager 1.2 rhem/flightctl-api-rhel9 1789485317, rhem/flightctl-api-rhel10 1789485653, rhem/flightctl-worker-rhel9 1789488061, rhem/flightctl-worker-rhel10 1789486740, rhem/flightctl-db-setup-rhel9 1789485698, rhem/flightctl-periodic-rhel9 1789485282, +18 more
    fixed: vendor fix RHSA-2026:68006
  • Red Hat Hardened Images helm4 4.2.3-0.1.2.hum1, helm3 3.21.3-0.1.2.hum1
    fixed: vendor fix RHSA-2026:42241
  • Red Hat OpenShift AI 3.4 rhoai/odh-rhel9-operator 1792040238, rhoai/odh-spark-operator-rhel9 1790958993
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift GitOps 1.20 openshift-gitops-1/argocd-rhel9 1791184378
    fixed: vendor fix RHSA-2026:77273
  • Red Hat OpenShift GitOps 1.21 openshift-gitops-1/argocd-rhel9 1791252092
    fixed: vendor fix RHSA-2026:77269
  • Red Hat Deployment Validation Operator dvo/deployment-validation-rhel8-operator
    not affected: inline mitigations already exist
  • Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Migration Toolkit for Virtualization 2.10 migration-toolkit-virtualization/mtv-api-rhel9 1791228191, migration-toolkit-virtualization/mtv-rhel9-operator 1791228160, migration-toolkit-virtualization/mtv-virt-v2v-rhel9 1791228348, migration-toolkit-virtualization/mtv-operator-bundle 1791281489, migration-toolkit-virtualization/mtv-ova-proxy-rhel9 1791228163, migration-toolkit-virtualization/mtv-controller-rhel9 1791228194, +7 more Red Hat Migration Toolkit for Virtualization 2.11 migration-toolkit-virtualization/mtv-api-rhel9 1791228807, migration-toolkit-virtualization/mtv-rhel9-operator 1791228757, migration-toolkit-virtualization/mtv-virt-v2v-rhel9 1791229014, migration-toolkit-virtualization/mtv-operator-bundle 1791616914, migration-toolkit-virtualization/mtv-ova-proxy-rhel9 1791228762, migration-toolkit-virtualization/mtv-controller-rhel9 1791228801, +7 more Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat OpenShift Developer Tools and Services helm Red Hat OpenShift Security Profiles Operator 1 compliance/openshift-selinuxd-rhel8 1790622898, compliance/openshift-selinuxd-rhel9 1790622902, compliance/openshift-selinuxd-rhel10 1790622978
    +9 more products
    Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/submariner-rhel9-operator, rhacm2/submariner-operator-bundle Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel9, advanced-cluster-security/rhacs-roxctl-rhel9, advanced-cluster-security/rhacs-rhel9-operator, advanced-cluster-security/rhacs-operator-bundle, advanced-cluster-security/rhacs-scanner-v4-rhel9 Red Hat Edge Manager 1 flightctl Red Hat Edge Manager 1.1 rhem/flightctl-ui-rhel10 1789486181, rhem/flightctl-ui-ocp-rhel9 1789486446, rhem/flightctl-ui-ocp-rhel10 1789486226 Red Hat Edge Manager 1.2 rhem/flightctl-ui-rhel9 1789486750, rhem/flightctl-ui-rhel10 1789488111, rhem/flightctl-ui-ocp-rhel9 1789486476, rhem/flightctl-ui-ocp-rhel10 1789485920 Red Hat Hardened Images oras, trivy, git-sync, opentofu1.10, opentofu1.11, opentofu1.12 Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-trainer-rhel9 1791869783, +98 more Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/cnf-tests-rhel8, openshift4/ose-console-rhel9, openshift4/ose-helm-operator, openshift4/ose-ansible-operator, openshift4/ose-olm-rukpak-rhel8, +20 more
    not affected: vulnerable code not present

7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
go oras.land/oras-go/v2
<2.6.1
2.6.1

Affected products

  • oras-project oras-go

Classification

Weakness
  • CWE-73 External Control of File Name or Path

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.