{"id":"CVE-2026-50162","title":"oras-go: oras-go: File store write outside working directory via symlink traversal (CVE-2026-50162)","summary":"A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link (symlink) traversal. A remote attacker, by providing a specially crafted blob tit…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"vendor","cwe":["CWE-22","CWE-73"],"vendor":"Red Hat","product":"Red Hat Edge Manager 1.1","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","deployment_validation_operator","mcp_server_for_red_hat_openshift","migration_toolkit_for_virtualization","openshift_lightspeed","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ceph_storage 9","developer_hub","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_gitops","openshift_virtualization 4","trusted_artifact_signer","trusted_profile_analyzer","web_terminal","security_profiles_operator","edge_manager 1.1","edge_manager 1.2","hardened_images"],"patched":["edge_manager 1.1","edge_manager 1.2","hardened_images"],"published":"2026-07-01","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:01:16+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50162.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50162.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-50162"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499694"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50162"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50162"},{"url":"https://github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv"},{"url":"https://access.redhat.com/errata/RHSA-2026:68044"},{"url":"https://access.redhat.com/errata/RHSA-2026:68253"},{"url":"https://access.redhat.com/errata/RHSA-2026:68006"},{"url":"https://access.redhat.com/errata/RHSA-2026:68254"},{"url":"https://access.redhat.com/errata/RHSA-2026:42241"},{"url":"https://access.redhat.com/errata/RHSA-2026:42230"},{"url":"https://github.com/oras-project/oras-go/commit/cc323e564d90c6b5b4bdd71d3c8d2ee2713b37e5"},{"url":"https://github.com/advisories/GHSA-8xwf-rjm4-xvhv"}],"tags":["csaf","vex","red-hat","ghsa","go"],"epss":0.00507,"epssPercentile":0.42265,"ecosystem":"go","ingestedAt":"2026-07-01T22:17:35.221Z","slug":"CVE-2026-50162","body":"## Overview\n\nA flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link (symlink) traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside the intended working directory. This filesystem boundary bypass allows for arbitrary file creation, potentially leading to unauthorized data modification or system compromise depending on the runtime environment.\n\n## Vendor advisories\n\n- **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044)\n- **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253)\n- **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006)\n- **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254)\n- **RHSA-2026:42241** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42241)\n- **RHSA-2026:42230** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42230)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Deployment Validation Operator, MCP Server for Red Hat OpenShift, Migration Toolkit for Virtualization, OpenShift Lightspeed, Red Hat Advanced Cluster Management for Kubernetes 2, … · no fix planned: MCP Server for Red Hat OpenShift, Red Hat Advanced Cluster Security 4, Red Hat Developer Hub, Red Hat Ceph Storage 9, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50162.json)\n\n**oras-go: oras-go: File store write outside working directory via symlink traversal** — rated Moderate by Red Hat. Released 2026-07-01, updated 2026-09-21.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Deployment Validation Operator\n- MCP Server for Red Hat OpenShift\n- Migration Toolkit for Virtualization\n- OpenShift Lightspeed\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ceph Storage 9\n- Red Hat Developer Hub\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift Virtualization 4\n- Red Hat Trusted Artifact Signer\n- Red Hat Trusted Profile Analyzer\n- Red Hat Web Terminal\n- Security Profiles Operator\n\nFixed:\n\n- Red Hat Edge Manager 1.1\n- Red Hat Edge Manager 1.2\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- MCP Server for Red Hat OpenShift\n- Red Hat Advanced Cluster Security 4\n- Red Hat Developer Hub\n- Red Hat Ceph Storage 9\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Virtualization 4\n- Red Hat Trusted Profile Analyzer\n- Red Hat Web Terminal\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Deployment Validation Operator\n- Migration Toolkit for Virtualization\n- OpenShift Lightspeed\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift GitOps\n- Red Hat Trusted Artifact Signer\n- Security Profiles Operator\n\nNot affected:\n\n- Red Hat Edge Manager 1.1\n- Red Hat Edge Manager 1.2\n- Gatekeeper 3\n- Multicluster Global Hub\n- OpenShift Developer Tools and Services\n- OpenShift Service Mesh 3\n- Red Hat Advanced Cluster Security 4\n- Red Hat Edge Manager 1\n- Red Hat Hardened Images\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nSee the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68044\nSee the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68253\nSee the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2 https://access.redhat.com/errata/RHSA-2026:68006\n\n## Package advisory (CVE-2026-50162)\n\nAffected packages:\n\n- `oras.land/oras-go/v2 < 2.6.1`\n\nPatched in:\n\n- `oras.land/oras-go/v2 2.6.1`\n\nSource: https://github.com/advisories/GHSA-8xwf-rjm4-xvhv","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":208491,"id":"CVE-2026-50162","ts":1790005719793,"field":"cvss","old":null,"new":"5.3"}]}