{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/oras-go--2.6.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["oras-go (\u003c= 2.6.1)"],"_cs_severities":["high"],"_cs_tags":["arbitrary-file-write","path-traversal","library-vulnerability","supply-chain"],"_cs_type":"advisory","_cs_vendors":["oras"],"content_html":"\u003cp\u003eThe \u003ccode\u003econtent/file.Store\u003c/code\u003e component in \u003ccode\u003eoras-go\u003c/code\u003e (versions \u003ccode\u003e\u0026lt;= v2.6.1\u003c/code\u003e) is vulnerable to an arbitrary file write attack during the extraction of OCI layer tarballs. The vulnerability is triggered when a descriptor includes the annotation \u003ccode\u003eio.deis.oras.content.unpack: \u0026quot;true\u0026quot;\u003c/code\u003e. The library performs lexical path validation using \u003ccode\u003efilepath.Join\u003c/code\u003e to ensure extracted files stay within the target extraction directory. However, this mechanism fails to account for kernel-level symlink resolution, where intermediate directory components may be symlinks that redirect subsequent path components.\u003c/p\u003e\n\u003cp\u003eAn attacker can create a malicious OCI layer containing a symlink chain that lexically appears to reside within the extraction root but resolves to an arbitrary absolute path at the kernel level. A follow-up regular file entry with the same name is then opened without \u003ccode\u003eO_NOFOLLOW\u003c/code\u003e flags, allowing the attacker to write content through the symlink and overwrite files outside the intended working directory. This vulnerability provides an RCE primitive for users or automated systems that extract untrusted container images using affected \u003ccode\u003eoras-go\u003c/code\u003e versions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker prepares a malicious OCI layer tarball and publishes it to a registry, setting \u003ccode\u003eio.deis.oras.content.unpack: \u0026quot;true\u0026quot;\u003c/code\u003e in the layer's descriptor.\u003c/li\u003e\n\u003cli\u003eThe victim invokes \u003ccode\u003eoras.Copy\u003c/code\u003e or a similar function to pull and unpack the malicious layer into a local directory using an affected \u003ccode\u003eoras-go\u003c/code\u003e version.\u003c/li\u003e\n\u003cli\u003eThe extraction routine parses the tar headers, creating a sequence of nested directories that facilitate a deep path structure.\u003c/li\u003e\n\u003cli\u003eThe library extracts a symlink entry named \u0026quot;up\u0026quot; that points back to the base extraction directory, which is validated lexically as compliant.\u003c/li\u003e\n\u003cli\u003eThe library extracts an \u0026quot;escape\u0026quot; symlink whose target is crafted with \u003ccode\u003e..\u003c/code\u003e components to cross the \u0026quot;up\u0026quot; symlink and escape the extraction root at the kernel-resolution level.\u003c/li\u003e\n\u003cli\u003eThe library extracts a regular file entry sharing the name \u0026quot;escape\u0026quot;, triggering the \u003ccode\u003ewriteFile\u003c/code\u003e logic.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ewriteFile\u003c/code\u003e function opens the path using \u003ccode\u003eos.OpenFile\u003c/code\u003e without \u003ccode\u003eO_NOFOLLOW\u003c/code\u003e, causing the kernel to follow the symlink and perform the write operation at the attacker-controlled absolute path.\u003c/li\u003e\n\u003cli\u003eThe final payload is written to the target location on the host, achieving arbitrary file overwrite.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to overwrite critical system files, configuration files, or binaries on the host system where \u003ccode\u003eoras-go\u003c/code\u003e is used for image extraction. This can lead to local privilege escalation or arbitrary code execution. The scope includes any application or service relying on \u003ccode\u003eoras-go\u003c/code\u003e for OCI artifact processing.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eoras-go\u003c/code\u003e to a version that addresses this vulnerability (post-v2.6.1) once a patch is available.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, restrict the environment where untrusted images are unpacked to a sandboxed, low-privilege container or a dedicated filesystem namespace.\u003c/li\u003e\n\u003cli\u003eImplement post-extraction integrity checks to ensure critical system files have not been modified by the container runtime or image manipulation tools.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected file modifications in sensitive directories (e.g., \u003ccode\u003e/etc/\u003c/code\u003e, \u003ccode\u003e/root/.ssh/\u003c/code\u003e) originating from processes that utilize \u003ccode\u003eoras-go\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-17T19:11:06Z","date_published":"2026-09-17T19:11:06Z","id":"https://feed.craftedsignal.io/briefs/2026-09-oras-go-symlink-bypass/","summary":"The oras-go library contains a path traversal vulnerability in its OCI layer extraction logic that allows attackers to overwrite arbitrary files on the host filesystem via a symlink-chain bypass.","title":"Arbitrary File Write in oras-go via Symlink-Chain Bypass","url":"https://feed.craftedsignal.io/briefs/2026-09-oras-go-symlink-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Oras-Go (\u003c= 2.6.1)","version":"https://jsonfeed.org/version/1.1"}