CVE-2026-85731: 
Trivy vulnerability analysis and mitigation

CVE-2026-85731 is a path traversal and symlink-following vulnerability in the oras-go Go library (oras.land/oras-go/v2) that allows arbitrary file write outside the file.Store working directory via a symlink-chain bypass during OCI layer tar extraction. It affects all versions of oras-go v2 up to and including v2.6.1, and is fixed in v2.6.2. The vulnerability was published on August 1, 2026 by maintainer TerryHowe and assigned CVE-2026-85731. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory GHSA-m37j-52j7-pjw7, Red Hat CVE).

The vulnerability is classified as CWE-22 (Path Traversal) and CWE-59 (Improper Link Resolution Before File Access / Link Following). Three root causes combine to enable exploitation in content/file/utils.go and content/file/file.go:

1. Lexical symlink validation (ensureLinkPath): Uses filepath.Join to validate symlink targets textually, which collapses .. components without dereferencing intermediate symlinks already extracted to disk.
2. Skipped parent-symlink check for root-level entries (resolveRelToBase): For entries whose filepath.Dir is . (i.e., placed directly at the extraction root), the per-component Lstat loop never executes, so the entry itself is never checked for being a symlink.
3. Symlink-following file write (writeFile): Opens files with os.O_WRONLY|os.O_CREATE|os.O_TRUNC and no O_NOFOLLOW, so if the target path is a symlink, the write follows it to the symlink's destination.

The attack is triggered via the pushDir path (content/file/file.go line 486) when a descriptor carries the annotation io.deis.oras.content.unpack=true. This code path was not covered by the checkSymlinkEscape fix introduced for the prior advisory GHSA-8xwf-rjm4-xvhv (GitHub Advisory GHSA-m37j-52j7-pjw7, Patch Commit).

Successful exploitation allows an attacker to create or overwrite any file writable by the process running oras-go, entirely outside the intended file.Store working directory. Practical escalation targets include ~/.ssh/authorized_keys, ~/.bashrc, Git hooks, or — when the process runs as root (e.g., in CI pipelines or Kubernetes controllers) — /etc/cron.d/* or binaries on $PATH, enabling remote code execution on the victim host. Confidentiality, integrity, and availability are all rated High, as the attacker can exfiltrate data, corrupt or replace critical files, and disrupt service. Downstream consumers such as the ORAS CLI (oras pull) and any tool built on oras-go that materializes artifact contents on disk are affected (GitHub Advisory GHSA-m37j-52j7-pjw7).

A complete, self-contained proof-of-concept Go program is publicly available in the GitHub Security Advisory, demonstrating arbitrary file write outside the store directory with output [!] BYPASS: wrote "PWNED-BY-ORAS-TARSLIP". The exploit requires no authentication to the victim system; the only precondition is that the victim pulls an attacker-controlled OCI artifact (User Interaction: Required). The EPSS score is reported as 0.0 at time of disclosure, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the advisory date. The NVD SSVC assessment classifies exploitation status as poc and technical impact as total (GitHub Advisory GHSA-m37j-52j7-pjw7, Red Hat Bugzilla).

1. Craft a malicious OCI layer: Build a tar.gz archive containing: (a) N nested directories title/d0/d1/.../d{N-1} where N equals the depth of the extraction base path baseAbs; (b) a symlink title/d0/.../d{N-1}/up pointing to N levels of ../ — both lexically and on disk this resolves to baseAbs, passing ensureLinkPath validation; (c) a symlink title/escape with target d0/.../d{N-1}/up/../../.../<absTarget> — lexically, filepath.Join cancels the .. components and keeps the path inside baseAbs, but the kernel follows up to baseAbs then climbs N levels to / and appends the attacker-chosen absolute path; (d) a regular file entry also named title/escape containing the attacker's payload.
2. Host the artifact on an attacker-controlled OCI registry: Set the layer descriptor annotations org.opencontainers.image.title=<title> and io.deis.oras.content.unpack=true. All content digests are honest, so content verification passes.
3. Induce the victim to pull the artifact: Social engineering, supply chain compromise, or DNS/BGP hijacking of a registry the victim already trusts. The victim runs oras.Copy(ctx, remoteRepo, ref, file.New(dir), ref, opts) or equivalent.
4. Trigger extraction: store.Push() invokes pushDir → extractTarGzip → extractTarDirectory. The symlink entries are extracted first; resolveRelToBase("escape") returns dir == "." so the Lstat loop never runs.
5. Achieve arbitrary file write: writeFile opens baseAbs/escape with O_WRONLY|O_CREATE|O_TRUNC and no O_NOFOLLOW; the kernel follows the symlink chain to the attacker-chosen absolute path and writes the payload there.
6. Escalate to code execution: Depending on the target path and process privileges, the written payload can be an SSH authorized key, a cron job, a shell RC file, or a binary on $PATH, leading to remote code execution (GitHub Advisory GHSA-m37j-52j7-pjw7).

• File System: Unexpected files appearing outside the file.Store working directory immediately after an oras pull or oras.Copy() operation (e.g., new files in ~/.ssh/, /etc/cron.d/, ~/.bashrc, or binaries on $PATH); presence of deeply nested directories named d0/d1/.../dN with a symlink named up inside the store's working directory; a symlink named escape at the root of the extraction title directory pointing to a path outside the store.
• Logs: Application or container logs showing store.Push() calls for layers annotated with io.deis.oras.content.unpack=true from unexpected or external registries; Go runtime errors or unexpected os.OpenFile calls in oras-go debug traces.
• Network: Outbound connections from the pulling host to unfamiliar OCI registry endpoints (non-standard ports or IPs) immediately before anomalous file creation; unusual manifest or blob fetch requests in registry access logs.
• Process: Unexpected child processes spawned by the application using oras-go shortly after an artifact pull (e.g., shell interpreters, cron, sshd reloads) (GitHub Advisory GHSA-m37j-52j7-pjw7).

Upgrade immediately to oras-go v2.6.2, which applies two fixes: (1) writeFile now removes any pre-existing terminal symlink at the target path before opening, preventing write-through; (2) extractTarDirectory re-verifies containment using the existing checkSymlinkEscape helper (which resolves symlinks via filepath.EvalSymlinks) before any filesystem mutation (Patch Commit, v2.6.2 Release). Until patching is possible, avoid pulling OCI artifacts from untrusted or unverified registries, and restrict the filesystem permissions of the process running oras-go to limit the blast radius of any write outside the working directory (GitHub Advisory GHSA-m37j-52j7-pjw7, Red Hat CVE).

Red Hat tracked the vulnerability via Bugzilla (Bug 2535549) and assigned it a high severity/priority rating, indicating downstream impact on Red Hat products that consume oras-go (Red Hat Bugzilla). The advisory was published by ORAS project maintainer TerryHowe and includes a detailed technical write-up with a complete PoC, reflecting a high level of transparency from the project. No significant broader media coverage or notable social media commentary was identified at time of disclosure.