Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

oras-go — Vulnerabilities & Security Advisories 6

All 6 CVE vulnerabilities found in oras-go, with AI-generated Chinese analysis, references, and POCs.

Vendor: oras-project

CVE ID Title CVSS Severity Published
CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) CWE-22 8.8 High 2026-09-16
CVE-2026-85732 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing CWE-918 4.7 Medium 2026-09-16
CVE-2026-50151 oras-go: credential forwarding via unvalidated Location header in blob upload CWE-918 7.5 High 2026-07-17
CVE-2026-50162 oras-go: file store write outside workingDir via symlink traversal CWE-73 - - 2026-07-17
CVE-2026-50163 oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction CWE-22 7.1 High 2026-07-17
CVE-2026-48978 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens CWE-918 - - 2026-07-17

All 6 known CVE vulnerabilities affecting oras-go with full Chinese analysis, references, and POCs where available.