The vulnerability of the `extractTarDirectory` and `ensureLinkPath` functions in the `content/file.Store` component of the oras-go programming language library allows a malicious actor to gain unauthorized access to create and re-write files.

The vulnerability of the extractTarDirectory and ensureLinkPath functions in the content/file.Store component of the oras-go library is related to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to create and...

GHSA-M37J-52J7-PJW7 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

Summary The content/file.Store in oras-go v2 unpacks OCI layer tarballs when a descriptor carries io.deis.oras.content.unpack=true. The extraction routine validates symlink targets purely lexically filepath.Join and, for regular files placed directly at the extraction root, skips the parent-symli...