Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oras.land/oras-go/v2 | go | <= 2.6.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal issue within the oras-go library's tar extraction functionality, specifically affecting the handling of hardlinks. The root cause lies in the ensureLinkPath function, which, despite validating a correctly resolved path, returns the original, potentially relative, and unresolved path of the hardlink target. The extractTarDirectory function then takes this unsafe path and passes it to os.Link. The os.Link call resolves relative paths against the process's current working directory (CWD), not the intended extraction directory. An attacker can exploit this by crafting a tar archive containing a hardlink with a relative path (e.g., ../somefile), causing oras-go to create a hardlink pointing to a file outside the extraction directory. This could be used to read or tamper with sensitive files in the CWD of the process executing the pull operation. The patch addresses this by modifying extractTarDirectory to explicitly resolve the target path against the link's directory before calling os.Link, ensuring the hardlink is created within the bounds of the extraction directory.
extractTarDirectorycontent/file/utils.go
ensureLinkPathcontent/file/utils.go