Medium [CVE-2026-50163] Information disclosure and arbitrary file access via crafted tarball hardlinks

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "/payload.tar.gz/evil_cwd_link") to resolve header.

Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as.env,.git/config,.aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

An attacker can exploit this vulnerability by providing a specially crafted tarball containing a malicious hardlink. When this tarball is extracted, the hardlink can be manipulated to point to files outside the intended extraction location, specifically within the victim's current working directory.

This allows an attacker to read sensitive information from the system, and in some cases, could lead to unauthorized access to critical system files if the component is operating with elevated privileges. A flaw was found in oras-go.

The ensureLinkPath tar extraction helper validates that a hardlink's target resolves inside the extract base directory, but returns the original unresolved target string instead of the validated path.