https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:17:24 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/cleanstart-2026-aq98798 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: tigera-operator</p> <p>Multiple security vulnerabilities affect the tigera-operator package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: tigera-operator</p> <p>Multiple security vulnerabilities affect the tigera-operator package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-aq98798 https://cve.radiocsirt.org/vuln/euvd-2026-338993 EUVD-2026-338993 https://cve.radiocsirt.org/vuln/euvd-2026-338993 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50162 <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -&gt; /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -&gt; /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50162 https://cve.radiocsirt.org/vuln/ghsa-8xwf-rjm4-xvhv <p><strong>Affected:</strong> Go: oras.land/oras-go/v2</p> <p>The file content store in `oras-go` attempts to confine writes to `workingDir` when `AllowPathTraversalOnWrite=false`, but the guard is lexical and does not account for symlink traversal. If `workingDir` contains a symlink path component and an attacker-controlled blob title (via `ocispec.AnnotationTitle`) targets a path under that symlink, `pushFile()` can create a file outside `workingDir`.</p> <p>## relevant links</p> <p>- repository: https://github.com/oras-project/oras-go - commit: 03243809936cce826494b5506f724c6dc11115b1 - callsite: content/file/file.go:609 `resolveWritePath()` (used by `pushFile()`)</p> <p>## vulnerability details</p> <p>**pins:** oras-project/oras-go@03243809936cce826494b5506f724c6dc11115b1</p> <p>**as-of:** 2026-02-17</p> <p>**policy:** GitHub Security Advisory (oras-project/oras-go)</p> <p>**callsite:** content/file/file.go:609 `resolveWritePath()` → `pushFile()`</p> <p>**attacker control:** Attacker controls the pushed name (`ocispec.AnnotationTitle`) and can select a path with a symlink path component under `workingDir` → `resolveWritePath()` blocks `..` via `filepath.Rel` but does not prevent symlink traversal → `pushFile()` opens/creates the final path and follows the symlink → a file is created outside `workingDir`</p> <p>### root cause</p> <p>`resolveWritePath()` enforces the write boundary using a `filepath.Rel`-style check against `workingDir`. This prevents `../` escapes but is purely lexical and does not resolve symlinks. If a path component under `workingDir` is a symlink to an external location,…</p> <p><strong>Affected:</strong> Go: oras.land/oras-go/v2</p> <p>The file content store in `oras-go` attempts to confine writes to `workingDir` when `AllowPathTraversalOnWrite=false`, but the guard is lexical and does not account for symlink traversal. If `workingDir` contains a symlink path component and an attacker-controlled blob title (via `ocispec.AnnotationTitle`) targets a path under that symlink, `pushFile()` can create a file outside `workingDir`.</p> <p>## relevant links</p> <p>- repository: https://github.com/oras-project/oras-go - commit: 03243809936cce826494b5506f724c6dc11115b1 - callsite: content/file/file.go:609 `resolveWritePath()` (used by `pushFile()`)</p> <p>## vulnerability details</p> <p>**pins:** oras-project/oras-go@03243809936cce826494b5506f724c6dc11115b1</p> <p>**as-of:** 2026-02-17</p> <p>**policy:** GitHub Security Advisory (oras-project/oras-go)</p> <p>**callsite:** content/file/file.go:609 `resolveWritePath()` → `pushFile()`</p> <p>**attacker control:** Attacker controls the pushed name (`ocispec.AnnotationTitle`) and can select a path with a symlink path component under `workingDir` → `resolveWritePath()` blocks `..` via `filepath.Rel` but does not prevent symlink traversal → `pushFile()` opens/creates the final path and follows the symlink → a file is created outside `workingDir`</p> <p>### root cause</p> <p>`resolveWritePath()` enforces the write boundary using a `filepath.Rel`-style check against `workingDir`. This prevents `../` escapes but is purely lexical and does not resolve symlinks. If a path component under `workingDir` is a symlink to an external location,…</p> https://cve.radiocsirt.org/vuln/ghsa-8xwf-rjm4-xvhv https://cve.radiocsirt.org/vuln/rhsa-2026:42230 <p>oras-go: oras-go: File store write outside working directory via symlink traversal golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input Helm: Helm: Denial of Service via malformed chart files</p> <p>oras-go: oras-go: File store write outside working directory via symlink traversal golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input Helm: Helm: Denial of Service via malformed chart files</p> https://cve.radiocsirt.org/vuln/rhsa-2026:42230 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50162 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-oras-oras-go, Ubuntu:26.04:LTS: golang-oras-oras-go</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -&gt; /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-oras-oras-go, Ubuntu:26.04:LTS: golang-oras-oras-go</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -&gt; /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50162