The oras-go library, used for managing OCI artifacts, contains a vulnerability in the resolveWritePath() function located in content/file/file.go. Before version 2.6.1, this function uses a lexical filepath.Rel check to validate paths relative to workingDir but does not account for symlink traversal. Consequently, if AllowPathTraversalOnWrite is set to false, an attacker can craft a blob title (via ocispec.AnnotationTitle) such as 'out/pwn.txt' where 'out' is a symlink pointing outside the working directory. This allows pushFile() to write files outside the intended directory, leading to external control of file paths. The vulnerability is addressed in version 2.6.1.

An attacker with the ability to control the blob title can cause files to be written outside the designated working directory by exploiting symlink traversal. This can lead to unauthorized file creation or overwriting in arbitrary locations on the filesystem, potentially impacting system integrity or security. The CVSS 4.0 base score is 6.9 (medium severity), indicating a significant but not critical risk.

This vulnerability is fixed in oras-go version 2.6.1. Users should upgrade to version 2.6.1 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor advisory stating the fix in 2.6.1.