oras-go is a Go library that manages OCI artifacts. The flaw, categorized as CWE‑22 and CWE‑73, occurs when resolveWritePath() performs a lexical path check without accounting for symbolic link traversal. An attacker who can control the blob title supplied via the ocispec.AnnotationTitle, such as out/pwn.txt, can cause pushFile() to write to a location outside the intended working directory if AllowPathTraversalOnWrite is false. This results in arbitrary file creation or modification, which can be leveraged to overwrite critical files when running with elevated privileges, potentially leading to a compromise of the host system. The CVSS score of 6.9 indicates medium severity.

The vulnerability affects oras‑project’s oras-go, specifically its file content store component. All versions prior to v2.6.1 are potentially vulnerable.

The CVSS score of 6.9 indicates a medium severity. The EPSS score is < 1%, and the vulnerability is not listed in the KEV catalog. The likely attack vector appears to be network‑based, inferred from the description of an attacker‑controlled blob title supplied over the network, so an attacker could trigger the issue remotely. The exploit would write files outside the working directory, allowing unauthorized data modification or compromise depending on the execution context.