Product
The oras-go library contains a path traversal vulnerability in its OCI layer extraction logic that allows attackers to overwrite arbitrary files on the host filesystem via a symlink-chain bypass.