CVE-2026-50162Medium· 5.3▾ SunlitA flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link (symlink) traversal. A remote attacker, by providing a specially crafted blob tit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.5%
— → 5.3
Last analysed / modified upstream
A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link (symlink) traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside the intended working directory. This filesystem boundary bypass allows for arbitrary file creation, potentially leading to unauthorized data modification or system compromise depending on the runtime environment.
oras-go: oras-go: File store write outside working directory via symlink traversal — rated Moderate by Red Hat. Released 2026-07-01, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv https://access.redhat.com/errata/RHSA-2026:83663
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.11/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv https://access.redhat.com/errata/RHSA-2026:83662
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to:
https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html https://access.redhat.com/errata/RHSA-2026:76752
Affected packages:
oras.land/oras-go/v2 < 2.6.1Patched in:
oras.land/oras-go/v2 2.6.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42306High· 7.2github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup (…
CVE-2020-27534Medium· 5.3moby/buildkit: calls os.OpenFile with a potentially unsafe qemu-check temporary pathname (CVE-2020-27534)
CVE-2026-55888High· 8.2xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames (CVE-2026-55888)
CVE-2026-115354Medium· 6.5mistune: mistune: Information disclosure via path traversal in Include directive (CVE-2026-115354)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)