CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
Attackers can overwrite arbitrary files via symlink chains in OCI layer extraction, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-85731?
CVE-2026-85731 is a high-severity path traversal vulnerability in oras-project oras-go, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.
Which versions are affected by CVE-2026-85731?
3 open source packages ship an affected version, including oras.land/oras-go/v2.
| Package | Affected | Fixed in |
|---|---|---|
oras.land/oras-go/v2 Go | All versions | 2.6.2 |
oras.land/oras-go/v2 Go | All versions | 2.6.2 |
oras.land/oras-go/v2 Go | All versions | 2.6.2 |
How do I fix CVE-2026-85731?
Upgrade oras.land/oras-go/v2 to 2.6.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-85731 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85731 exists.
Sources
Also known as CLEANSTART-2026-DR73379, CLEANSTART-2026-JS28997, CLEANSTART-2026-VN99750, DEBIAN-CVE-2026-85731, ECHO-5e20-171c-362a, GHSA-m37j-52j7-pjw7 and 184 more.