CVE-2026-50162: oras-go: file store write outside workingDir via symlink traversal

Deferred

AliasesUBUNTU-CVE-2026-50162DEBIAN-CVE-2026-50162CGA-22vf-59wm-grr4+618 more

Published 17-07-2026Last modified 20-07-2026

Vulnerability summary

CVE-2026-50162 is a medium (CVSS 6.9) External Control of File Name or Path vulnerability in oras-project oras-go. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 38% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.9/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.44%

0%100%

Low · -0.07 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 4

OPENSUSE-SU-2026:21551-1 RHSA-2026:42230 RHSA-2026:42241 SUSE-SU-2026:23216-1 SUSE-SU-2026:23227-1 CGA-67PX-Q2R2-V28W

Timeline

17-07-2026
PublishedVulnerability first disclosed.
20-07-2026
Last modifiedVulnerability information updated.

Description

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.

CVSS metrics

7 scores · 7 sources · 1 version

v4.06.9

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

Decrease -0.07 pp

From 0.51% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1All versions (No fix recorded)
argo-cd-3.1-compatAll versions (No fix recorded)
argo-cd-3.2< 3.2.12-r5

argo-cd-3.2-compat< 3.2.12-r5
argo-cd-3.3< 3.3.12-r3
argo-cd-3.3-compat< 3.3.14-r9
argo-cd-3.4< 3.4.4-r2
argo-cd-3.4-compat< 3.4.4-r2
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1< 3.1.16-r14
argo-cd-fips-3.1-compat< 3.1.16-r14
argo-cd-fips-3.2< 3.2.12-r9
argo-cd-fips-3.2-compat< 3.2.12-r9
argo-cd-fips-3.3< 3.3.12-r4
argo-cd-fips-3.3-compat< 3.3.12-r4
argo-cd-fips-3.4< 3.4.4-r3
argo-cd-fips-3.4-compat< 3.4.4-r3
argocd-image-updater< 1.2.2-r2
argocd-image-updater-fips< 1.2.2-r1
cert-manager-cmctl< 2.5.0-r9
cert-manager-cmctl-fips< 2.5.0-r5
chaos-mesh< 2.8.3-r4
chaos-mesh-fips< 2.8.3-r3
chartmuseum< 0.16.5-r16
chartmuseum-fips< 0.16.5-r15
cilium-cli< 0.19.5-r1
cloudbeat-8.17< 8.17.10-r29
cloudbeat-9.0< 9.0.8-r31
cloudbeat-9.1< 9.1.10-r24
cloudbeat-9.2< 9.2.8-r13
cloudbeat-fips-8.17< 8.17.10-r34
cloudbeat-fips-9.0< 9.0.8-r35
cloudbeat-fips-9.1< 9.1.10-r27
cloudbeat-fips-9.2< 9.2.8-r10
cluster-api-helm-controller< 0.6.4-r9
cluster-api-helm-controller-fips< 0.6.4-r8
commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-19.5All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.5All versions (No fix recorded)
commercial-kyverno-1.13All versions (No fix recorded)
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-1.17< 1.17.2-r0
commercial-kyverno-background-controller-1.13All versions (No fix recorded)
commercial-kyverno-background-controller-1.14All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.17< 1.17.2-r0
commercial-kyverno-cleanup-controller-1.13All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.14All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.16All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.17< 1.17.2-r0
commercial-kyverno-reports-controller-1.13All versions (No fix recorded)
commercial-kyverno-reports-controller-1.14All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.16All versions (No fix recorded)
commercial-kyverno-reports-controller-1.17< 1.17.2-r0
commercial-kyvernopre-1.13All versions (No fix recorded)
commercial-kyvernopre-1.14All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
commercial-kyvernopre-1.16All versions (No fix recorded)
commercial-kyvernopre-1.17< 1.17.2-r0
conftest< 0.68.2-r5
conftest-fips< 0.68.2-r7
consul-k8s-1.1-cli< 1.1.18-r41
consul-k8s-1.3-cli< 1.3.9-r47
consul-k8s-1.4-cli< 1.4.10-r33
consul-k8s-1.5-cli< 1.5.9-r31
consul-k8s-1.6-cli< 1.6.10-r25
consul-k8s-1.7-cli< 1.7.13-r15
consul-k8s-1.9-cli< 1.9.9-r1
consul-k8s-2.0-cli< 2.0.1-r2
consul-k8s-fips-1.1-cli< 1.1.18-r40
consul-k8s-fips-1.3-cli< 1.3.9-r43
consul-k8s-fips-1.4-cli< 1.4.10-r32
consul-k8s-fips-1.5-cli< 1.5.9-r33
consul-k8s-fips-1.6-cli< 1.6.10-r26
consul-k8s-fips-1.7-cli< 1.7.13-r17
consul-k8s-fips-1.9-cli< 1.9.9-r2
consul-k8s-fips-2.0-cli< 2.0.1-r3
crossplane-2.3-crank< 2.3.3-r5
crossplane-fips-2.3-crank< 2.3.3-r3
drone< 3.3.0-r8
drone-fips< 3.3.0-r8
eksctl< 0.229.0-r1
envoy-gateway-1.5-egctl< 1.5.9-r1
envoy-gateway-1.6-egctl< 1.6.7-r1
envoy-gateway-1.7-egctl< 1.7.4-r1
envoy-gateway-fips-1.5-egctl< 1.5.9-r1
envoy-gateway-fips-1.6-egctl< 1.6.7-r1
envoy-gateway-fips-1.7-egctl< 1.7.4-r1
falcoctl< 0.13.0-r10
falcoctl-fips< 0.13.0-r8
falcoctl-fips-0.4All versions (No fix recorded)
gatekeeper-3.21-gatorAll versions (No fix recorded)
gatekeeper-3.22-gator< 3.22.2-r7
gitlab-operator< 3.1.1-r1
gitlab-operator-fips< 3.1.1-r1
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0All versions (No fix recorded)
gitlab-rails-ce-19.1All versions (No fix recorded)
gitlab-rails-ce-19.2All versions (No fix recorded)
gitlab-rails-ce-19.3All versions (No fix recorded)
gitlab-rails-ce-19.4All versions (No fix recorded)
gitlab-rails-ce-19.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.10All versions (No fix recorded)
gitlab-rails-ce-fips-18.11All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-19.0All versions (No fix recorded)
gitlab-rails-ce-fips-19.1All versions (No fix recorded)
gitlab-rails-ce-fips-19.2All versions (No fix recorded)
gitlab-rails-ce-fips-19.3All versions (No fix recorded)
gitlab-rails-ce-fips-19.4All versions (No fix recorded)
gitlab-rails-ce-fips-19.5All versions (No fix recorded)
gitness< 3.3.0-r25
gogatekeeper< 4.10.0-r2
headlamp< 0.43.0-r3
headlamp-fips< 0.43.0-r5
helm-3< 3.22.0-r0
helm-exporter< 1.3.0-r14
helm-exporter-fips< 1.3.0-r14
helm-mapkubeapis< 0.6.1-r22
helm-operator< 1.42.3-r1
helm-operator-fips< 1.42.3-r2
helm-push< 0.11.1-r17
helm-set-status< 0.3.0-r22
jfrog-cli< 2.112.0-r0
k8ssandra-client< 0.8.14-r2 | All versions (No fix recorded) | < 0.9.1-r2
k8ssandra-client-fips< 0.8.14-r1
k9s< 0.51.0-r5
k9s-fips< 0.51.0-r4
kargo< 1.10.8-r2
kgateway-2.3< 2.3.5-r3
kgateway-fips-2.3< 2.3.5-r2
kots< 1.130.6-r2
kube-arangodb-1.3All versions (No fix recorded)
kube-arangodb-1.4< 1.4.3-r14
kube-arangodb-fips-1.3All versions (No fix recorded)
kube-arangodb-fips-1.4< 1.4.3-r8
kube-mgmt< 11.0.7-r6
kube-mgmt-fips< 11.0.7-r8
kubescape< 4.0.10-r3
kubescape-operatorAll versions (No fix recorded) | < 0.2.151-r4 | < 0.2.172-r2
kubescape-operator-fips< 0.2.151-r6
kubescape-server< 4.0.10-r3
kubescape-server-downloader< 4.0.10-r3
kubescape-server-fips< 4.0.10-r4
kubescape-server-fips-downloader< 4.0.10-r4
kubevela-vela-cliAll versions (No fix recorded)
kubevela-vela-cli-fipsAll versions (No fix recorded)
kubevela-vela-coreAll versions (No fix recorded)
kubevela-vela-core-fipsAll versions (No fix recorded)
kyverno-1.14All versions (No fix recorded)
kyverno-1.15< 1.15.3-r24
kyverno-1.16< 1.16.4-r12
kyverno-1.17All versions (No fix recorded) | < 1.17.2-r35
kyverno-1.18< 1.18.1-r11
kyverno-background-controller-1.14All versions (No fix recorded)
kyverno-background-controller-1.15< 1.15.3-r24
kyverno-background-controller-1.16< 1.16.4-r12
kyverno-background-controller-1.17< 1.17.2-r17
kyverno-background-controller-1.18< 1.18.1-r11
kyverno-background-controller-fips-1.14All versions (No fix recorded)
kyverno-background-controller-fips-1.15< 1.15.20-r9
kyverno-background-controller-fips-1.16< 1.16.4-r11
kyverno-background-controller-fips-1.17< 1.17.2-r12
kyverno-background-controller-fips-1.18< 1.18.2-r3
kyverno-cleanup-controller-1.14All versions (No fix recorded)
kyverno-cleanup-controller-1.15< 1.15.3-r24
kyverno-cleanup-controller-1.16< 1.16.4-r12
kyverno-cleanup-controller-1.17< 1.17.2-r17
kyverno-cleanup-controller-1.18< 1.18.1-r11
kyverno-cleanup-controller-fips-1.14All versions (No fix recorded)
kyverno-cleanup-controller-fips-1.15< 1.15.20-r9
kyverno-cleanup-controller-fips-1.16< 1.16.4-r11
kyverno-cleanup-controller-fips-1.17< 1.17.2-r12
kyverno-cleanup-controller-fips-1.18< 1.18.2-r3
kyverno-cli-1.14All versions (No fix recorded)
kyverno-cli-1.15< 1.15.3-r24
kyverno-cli-1.17< 1.17.2-r35 | < 1.17.2-r17
kyverno-cli-1.18< 1.18.1-r11
kyverno-cli-fips-1.14All versions (No fix recorded)
kyverno-cli-fips-1.15< 1.15.20-r9
kyverno-cli-fips-1.16< 1.16.4-r11
kyverno-cli-fips-1.18< 1.18.2-r3

Show all 200

1 vendor · 200 products · Showing 200 of 413

References

9 links

github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhvX Refsource CONFIRMREPORTAdvisoryWEB
github.com/oras-project/oras-go/commit/cc323e564d90c6b5b4bdd71d3c8d2ee2713b37e5X Refsource MISCFIXWEB
github.com/oras-project/oras-go/releases/tag/v2.6.1X Refsource MISCWEB
ubuntu.com/security/CVE-2026-50162REPORT
www.cve.org/CVERecord?id=CVE-2026-50162REPORT
security-tracker.debian.org/tracker/CVE-2026-50162Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50162.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-50162Advisory
github.com/oras-project/oras-goPACKAGE