CVE-2026-50162
Vulnerability Summary
Timeline
Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.
CVSS Metrics
- v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Trends
Current EPSS score: 0.51%• Percentile: 42%
Techniques & Countermeasures
- CWE-73•External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
Affected Systems
- chainguard•argo-cd-3.0
all
- chainguard•argo-cd-3.0-compat
all
- chainguard•argo-cd-3.1
all
- chainguard•argo-cd-3.1-compat
all
- chainguard•argo-cd-3.2
< 3.2.12-r5
- chainguard•argo-cd-3.2-compat
< 3.2.12-r5
- chainguard•argo-cd-3.3
< 3.3.12-r3
- chainguard•argo-cd-3.3-compat
< 3.3.14-r9
- chainguard•argo-cd-3.4
< 3.4.4-r2
- chainguard•argo-cd-3.4-compat
< 3.4.4-r2
- chainguard•argo-cd-fips-3.0
all
- chainguard•argo-cd-fips-3.0-compat
all
- chainguard•argo-cd-fips-3.1
all | < 3.1.16-r14
- chainguard•argo-cd-fips-3.1-compat
all | < 3.1.16-r14
- chainguard•argo-cd-fips-3.2
< 3.2.12-r9
- chainguard•argo-cd-fips-3.2-compat
< 3.2.12-r9
- chainguard•argo-cd-fips-3.3
< 3.3.12-r4
- chainguard•argo-cd-fips-3.3-compat
< 3.3.12-r4
- chainguard•argo-cd-fips-3.4
< 3.4.4-r3
- chainguard•argo-cd-fips-3.4-compat
< 3.4.4-r3
- chainguard•argocd-image-updater
< 1.2.2-r2
- chainguard•argocd-image-updater-fips
< 1.2.2-r1
- chainguard•cert-manager-cmctl
< 2.5.0-r9
- chainguard•cert-manager-cmctl-fips
< 2.5.0-r5
- chainguard•chaos-mesh
< 2.8.3-r4
- chainguard•chaos-mesh-fips
< 2.8.3-r3
- chainguard•chartmuseum
< 0.16.5-r16
- chainguard•chartmuseum-fips
< 0.16.5-r15
- chainguard•cilium-cli
< 0.19.5-r1
- chainguard•cloudbeat-8.17
< 8.17.10-r29
- chainguard•cloudbeat-9.0
< 9.0.8-r31
- chainguard•cloudbeat-9.1
< 9.1.10-r24
- chainguard•cloudbeat-9.2
< 9.2.8-r13
- chainguard•cloudbeat-fips-8.17
< 8.17.10-r34
- chainguard•cloudbeat-fips-9.0
< 9.0.8-r35
- chainguard•cloudbeat-fips-9.1
< 9.1.10-r27
- chainguard•cloudbeat-fips-9.2
< 9.2.8-r10
- chainguard•cluster-api-helm-controller
< 0.6.4-r9
- chainguard•cluster-api-helm-controller-fips
< 0.6.4-r8
- chainguard•commercial-kyverno-1.13
all
- chainguard•commercial-kyverno-1.14
all
- chainguard•commercial-kyverno-1.15
all
- chainguard•commercial-kyverno-1.16
all
- chainguard•commercial-kyverno-1.17
all
- chainguard•commercial-kyverno-background-controller-1.13
all
- chainguard•commercial-kyverno-background-controller-1.14
all
- chainguard•commercial-kyverno-background-controller-1.15
all
- chainguard•commercial-kyverno-background-controller-1.16
all
- chainguard•commercial-kyverno-background-controller-1.17
all
- chainguard•commercial-kyverno-cleanup-controller-1.13
all
Showing first 50 affected entries in server-rendered view.
References (9)
- https://github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv
- https://github.com/oras-project/oras-go/commit/cc323e564d90c6b5b4bdd71d3c8d2ee2713b37e5
- https://github.com/oras-project/oras-go
- https://github.com/oras-project/oras-go/releases/tag/v2.6.1
- https://ubuntu.com/security/CVE-2026-50162
- https://www.cve.org/CVERecord?id=CVE-2026-50162
- https://security-tracker.debian.org/tracker/CVE-2026-50162
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50162.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-50162