Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal weakness in the oras-go library, specifically within the file content store. The root cause lies in the (*Store).resolveWritePath function, which was intended to restrict file writes to a designated working directory. The function's validation was insufficient because it only performed a lexical check for directory traversal sequences (like ../) and did not resolve or validate symlinks within the file path. An attacker could exploit this by crafting a blob title that corresponds to a file path containing a symlink. This symlink could point to a location outside the intended working directory. When the (*Store).pushFile function calls (*Store).resolveWritePath for validation, the check would pass due to its lexical nature. Subsequently, (*Store).pushFile would proceed with the write operation, and the underlying operating system would follow the symlink, resulting in a file being created outside the sandboxed directory. The patch addresses this by introducing a new function, checkSymlinkEscape, which resolves symlinks in the path and ensures the resulting absolute path is still within the intended working directory before permitting the write. The key vulnerable functions are (*Store).resolveWritePath due to its flawed validation logic and (*Store).pushFile for executing the unsafe write based on the untrusted path.
(*Store).resolveWritePathcontent/file/file.go
(*Store).pushFilecontent/file/file.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oras.land/oras-go/v2 | go | < 2.6.1 | 2.6.1 |