CVE-2026-50162: 
Trivy vulnerability analysis and mitigation

CVE-2026-50162 is a symlink traversal vulnerability in the oras-go library (Go module oras.land/oras-go/v2) that allows an attacker-controlled blob title to cause file writes outside the intended workingDir boundary. The vulnerability was identified as of February 17, 2026, published as a GitHub Security Advisory (GHSA-8xwf-rjm4-xvhv) on June 11, 2026, and added to the GitHub Advisory Database on July 1, 2026. It affects versions of oras.land/oras-go/v2 prior to 2.6.1 (with the security advisory also noting v2.6.0 specifically, patched in v2.6.2). The CVSS v4.0 base score is 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-73 (External Control of File Name or Path), with an additional estimate of CWE-22 (Path Traversal). The vulnerable function resolveWritePath() in content/file/file.go (line 609) enforces the workingDir write boundary using a lexical filepath.Rel-style check, which blocks ../ escapes but does not resolve symlinks. When workingDir contains a symlink directory (e.g., out -> /some/outside/dir) and an attacker supplies a blob title via ocispec.AnnotationTitle such as out/pwn.txt, the lexical check passes because out/pwn.txt appears to be under workingDir, but the subsequent pushFile() call follows the symlink and writes the file to /some/outside/dir/pwn.txt. The fix (commit cc323e5) adds a checkSymlinkEscape() helper that resolves symlinks via filepath.EvalSymlinks on both the base and the deepest existing ancestor of the write target, then re-validates the real path remains under the real workingDir (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to write arbitrary files to filesystem locations outside the intended workingDir confinement boundary, violating the security guarantee of AllowPathTraversalOnWrite=false. The concrete impact depends on the runtime environment — specifically, which filesystem paths are writable by the process and what downstream consumers do with the written files. In privileged or container-adjacent environments (e.g., Kubernetes operators using oras-go for OCI artifact management), this could enable overwriting configuration files, injecting malicious scripts, or achieving code execution if writable paths include executable or auto-loaded locations (GitHub Advisory, ORAS-go Advisory).

1. Identify a target: Find an application or service using oras.land/oras-go/v2 versions prior to 2.6.1 that pulls OCI artifacts from an attacker-influenced registry or accepts attacker-controlled OCI manifests.
2. Verify symlink precondition: Confirm or arrange that the victim's workingDir contains at least one symlink directory component pointing to a location outside workingDir (e.g., workingDir/out -> /etc/cron.d).
3. Craft a malicious OCI artifact: Create an OCI artifact blob with ocispec.AnnotationTitle set to a path that traverses through the symlink, such as out/malicious.sh. This path passes the lexical filepath.Rel check since it does not contain ../.
4. Push or serve the artifact: Host the malicious artifact on an OCI registry accessible to the victim application, or inject it into a registry the victim trusts.
5. Trigger the pull: Cause the victim application to pull the artifact using the oras-go file store with AllowPathTraversalOnWrite=false. The pushFile() function follows the symlink and writes the file to the external location (e.g., /etc/cron.d/malicious.sh).
6. Achieve objective: Depending on the written location and file content, achieve persistence, privilege escalation, or code execution (GitHub Advisory, ORAS-go Advisory).

• File System: Unexpected files appearing in directories outside the application's designated workingDir, particularly in sensitive locations such as /etc/, cron directories, or application config paths; symlink directories present under workingDir pointing to external locations.
• Logs: Application logs showing OCI artifact pulls with blob titles containing path separators (e.g., out/filename.txt) where out resolves to a symlink; errors or unexpected file creation events logged by the host OS audit daemon (auditd) for writes to sensitive paths by the oras-go-based process.
• Process: Unexpected file creation events from the application process in directories it should not normally write to, observable via tools like inotifywait or fanotify-based monitoring.

Upgrade oras.land/oras-go/v2 to version 2.6.1 or later (the GitHub Advisory Database lists 2.6.1 as the patched version; the project's own security advisory lists v2.6.2 as the patched version — upgrading to the latest available release is recommended). The fix is implemented in commit cc323e5, which adds symlink-aware validation via checkSymlinkEscape() after the existing lexical check. As a workaround where upgrading is not immediately possible, ensure that no symlink directory components exist under the workingDir used by the file store, and restrict the OCI registries from which artifacts are pulled to fully trusted sources. Downstream projects such as pulumi-kubernetes have already issued dependency updates (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher "1seal" (Oleh) and addressed by maintainer TerryHowe of the ORAS project. Tenable published a cloud security plugin (ID 444261) covering this advisory, and the OSV database indexed the advisory shortly after publication. The pulumi-kubernetes project issued a dependency update commit in response. No significant broader media coverage or social media discussion has been identified beyond standard advisory tracking (GitHub Advisory).