oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in
    content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the
    unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to
    resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such
    as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack:
    "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and
    ~/.ssh/config. This issue is fixed in version 2.6.2. (CVE-2026-50163)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in     content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the     unresolved target, causing os.Link(victim.secret, <extract_base>/payload.tar.gz/evil_cwd_link) to     resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such     as Name=payload.tar.gz/evil_cwd_link and Linkname=victim.secret with io.deis.oras.content.unpack:
    true, which can expose or tamper with files such as .env, .git/config, .aws/credentials, and     ~/.ssh/config. This issue is fixed in version 2.6.2. (CVE-2026-50163)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
445682	SCA: security update for oras.land/oras-go/v2 (GHSA-fxhp-mv3v-67qp)	Tenable Cloud Security	SCA Checks	Local	high
445682	SCA: security update for oras.land/oras-go/v2 (GHSA-fxhp-mv3v-67qp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
327772	Linux Distros Unpatched Vulnerability : CVE-2026-50163	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-50163

high

Tenable Plugins

high

high

high