The oras-go library versions before 2.6.2 contain a path traversal vulnerability (CWE-22) in the content/file.Store extraction process. Specifically, when extracting OCI layers marked with io.deis.oras.content.unpack=true, the library's path validation logic can be bypassed by a malicious archive that creates a symlink chain. Although the lexical target remains inside the extraction root, the resolved absolute path points outside, allowing an attacker to overwrite arbitrary files writable by the process. This occurs because resolveRelToBase skips parent-symlink walks for root-level entries and writeFile follows terminal symlinks when opening files. This vulnerability can lead to arbitrary file overwrite and potential code execution. The flaw is addressed in version 2.6.2.

An attacker who can supply a malicious OCI artifact can cause the oras-go library to overwrite arbitrary files on the host filesystem with the privileges of the process running oras-go. This can lead to code execution or other severe impacts depending on the overwritten files. The vulnerability has a high CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability.

Upgrade to oras-go version 2.6.2 or later, where this path traversal vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory stating the issue is fixed in 2.6.2.