GHSA-8xwf-rjm4-xvhv — oras-go has file store write outside workingDir via symlink traversal

Affected: Go: oras.land/oras-go/v2

The file content store in `oras-go` attempts to confine writes to `workingDir` when `AllowPathTraversalOnWrite=false`, but the guard is lexical and does not account for symlink traversal. If `workingDir` contains a symlink path component and an attacker-controlled blob title (via `ocispec.AnnotationTitle`) targets a path under that symlink, `pushFile()` can create a file outside `workingDir`.

## relevant links

- repository: https://github.com/oras-project/oras-go - commit: 03243809936cce826494b5506f724c6dc11115b1 - callsite: content/file/file.go:609 `resolveWritePath()` (used by `pushFile()`)

## vulnerability details

**pins:** oras-project/oras-go@03243809936cce826494b5506f724c6dc11115b1

**as-of:** 2026-02-17

**policy:** GitHub Security Advisory (oras-project/oras-go)

**callsite:** content/file/file.go:609 `resolveWritePath()` → `pushFile()`

**attacker control:** Attacker controls the pushed name (`ocispec.AnnotationTitle`) and can select a path with a symlink path component under `workingDir` → `resolveWritePath()` blocks `..` via `filepath.Rel` but does not prevent symlink traversal → `pushFile()` opens/creates the final path and follows the symlink → a file is created outside `workingDir`

### root cause

`resolveWritePath()` enforces the write boundary using a `filepath.Rel`-style check against `workingDir`. This prevents `../` escapes but is purely lexical and does not resolve symlinks. If a path component under `workingDir` is a symlink to an external location,…

Most recent entries from all

GHSA-8xwf-rjm4-xvhv — oras-go has file store write outside workingDir via symlink traversal