Vulnerability GO-2026-6499
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
6 hours ago
October 01, 2026 at 08:23 PM UTC
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go
v2.0.0-alpha - v2.6.1
v2.0.0-alpha - v2.6.1
Summary
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go
Details
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
6 hours ago
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go
v2.0.0-alpha - v2.6.1 GO-2026-6497
v2.0.0-alpha - v2.6.1 GO-2026-6497
Medium Risk
14 days ago
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
v2.0.0-alpha - v2.6.1 GHSA-h7vf-4x9w-h99v
v2.0.0-alpha - v2.6.1 GHSA-h7vf-4x9w-h99v
High Risk
14 days ago
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
v2.0.0-alpha - v2.6.1 GHSA-m37j-52j7-pjw7
v2.0.0-alpha - v2.6.1 GHSA-m37j-52j7-pjw7
Unknown
2 months ago
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go
v2.0.0-alpha - v2.6.0 GO-2026-5879
v2.0.0-alpha - v2.6.0 GO-2026-5879
Unknown
2 months ago
Hardlink path traversal during tar extraction in oras.land/oras-go
v2.0.0-alpha - v2.6.1 GO-2026-5880
v2.0.0-alpha - v2.6.1 GO-2026-5880
Impacted packages
Timeline
Published
6 hours ago
October 01, 2026 at 08:23 PM UTC
Last Modified
6 hours ago
October 01, 2026 at 08:45 PM UTC