CVE-2026-50163 `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution
Attackers can escape extraction directories via hardlink path traversal in oras-go, potentially reading or modifying sensitive files like credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-50163?
CVE-2026-50163 is a high-severity path traversal vulnerability in oras-project oras-go, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.
Which versions are affected by CVE-2026-50163?
3 open source packages ship an affected version, including oras.land/oras-go/v2.
| Package | Affected | Fixed in |
|---|---|---|
oras.land/oras-go/v2 Go | All versions | 2.6.2 |
oras.land/oras-go/v2 Go | All versions | 2.6.2 |
oras.land/oras-go/v2 Go | All versions | 2.6.2 |
Linux distribution packages (1)
oras openSUSE:Tumbleweed | All versions | 1.3.3-2.1 |
How do I fix CVE-2026-50163?
Upgrade oras.land/oras-go/v2 to 2.6.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-50163 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50163 exists.
Sources
Also known as CLEANSTART-2026-AH23737, CLEANSTART-2026-BF41428, CLEANSTART-2026-NW06538, CLEANSTART-2026-PW54184, DEBIAN-CVE-2026-50163, GHSA-fxhp-mv3v-67qp and 216 more.