VDB
Sign up
HIGH8.8

GO-2026-6499

Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

Quick fix

GO-2026-6499 — oras.land/oras-go/v2: upgrade to the fixed version with the command below.

go get oras.land/oras-go/v2@v2.6.2

Details

Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/oras.land/oras-go/v2
Introduced in: 0Fixed in: 2.6.2
Fixgo get oras.land/oras-go/v2@v2.6.2

References