PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50162 oras-project CVE debrief

The CVE record for CVE-2026-50162 was published on 2026-07-17T20:17:23.817Z and has not been modified since then. The NVD entry is currently 6.9 MEDIUM. This vulnerability affects the oras-go library, used for managing OCI artifacts, and involves a path traversal issue prior to version 2.6.1. The vulnerability allows an attacker to create files outside the working directory due to insufficient symlink traversal checks in the resolveWritePath() function.

Vendor
oras-project
Product
oras-go
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-17
Original CVE updated
2026-07-20
Advisory published
2026-07-17
Advisory updated
2026-07-20

Who should care

Users of the oras-go library, particularly those who handle OCI artifacts, should be aware of this vulnerability and take steps to defend against it. This includes reviewing their deployments, validating and sanitizing user input, and implementing proper path traversal checks. Affected operators, platforms, and security teams should prioritize updating to version 2.6.1 or later.

Technical summary

The oras-go library, used for managing OCI artifacts, had a path traversal vulnerability prior to version 2.6.1. The resolveWritePath() function in content/file/file.go did not account for symlink traversal, allowing an attacker to create files outside the working directory. This issue was fixed in version 2.6.1. Users of the oras-go library, particularly those who handle OCI artifacts, should be aware of this vulnerability and take steps to defend against it.

Defensive priority

Medium

Recommended defensive actions

  • Update oras-go to version 2.6.1 or later
  • Validate and sanitize user input
  • Implement proper path traversal checks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and testing may be necessary to fully understand the impact and defend against it. The oras-go library, used for managing OCI artifacts, had a path traversal vulnerability prior to version 2.6.1. The resolveWritePath() function in content/file/file.go did not account for symlink traversal, allowing an attacker to create files outside the working directory. Users should verify their deployments and review the official advisory for affected scope and vendor guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50162 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50162

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50162 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50162

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.