← All advisories

Moderate severity5.9NVD Advisory· Published Jul 1, 2026

oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks

CVE-2026-50163

Description

oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks

Affected products

19

Oras Go/oras-gollm-fuzzy
osv-coords18 versions
pkg:apk/chainguard/oras pkg:apk/chainguard/oras-fips pkg:apk/chainguard/ratify pkg:apk/chainguard/ratify-fips pkg:apk/chainguard/ratify-fips-licensechecker pkg:apk/chainguard/ratify-fips-sbom pkg:apk/chainguard/ratify-fips-schemavalidator pkg:apk/chainguard/ratify-fips-vulnerabilityreport pkg:apk/chainguard/ratify-licensechecker pkg:apk/chainguard/ratify-sbom pkg:apk/chainguard/ratify-schemavalidator pkg:apk/chainguard/ratify-vulnerabilityreport pkg:apk/wolfi/oras pkg:apk/wolfi/ratify pkg:apk/wolfi/ratify-licensechecker pkg:apk/wolfi/ratify-sbom pkg:apk/wolfi/ratify-schemavalidator pkg:apk/wolfi/ratify-vulnerabilityreport
< 1.3.3-r0+ 17 more
- (no CPE)range: < 1.3.3-r0
- (no CPE)range: < 1.3.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.3.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0
- (no CPE)range: < 1.4.3-r0

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.