VDB
RHSA-2026:83662
RHSA-2026:83662
PUBLISHED
CVSS 8.100000381469727 HIGH
A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link (symlink) traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside the intended working directory. This filesystem boundary bypass allows for arbitrary file creation, potentially leading to unauthorized data modification or system compromise depending on the runtime environment.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1dd8b8ea9dde297dbf9dea4ffb6e630cf8547b34c4de565d1fb657ad344db33d_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:4f062b8d9c4151cd772b33761f351886115198ae16d06a1be18e8aa99dff9b84_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:1a64d633b57fe3f287f850a32b8944acebeb53b9f2635360c1828f052fe14dfe_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:25b3df137db02c1a5962d4b4facda8047d172fae24e21dc3ef970a8dfb152605_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:e63d82f2af0a9211b6a7bf6ec08940557dd3091ad4c9a4f7e663c25660821900_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:be057c014f23d0ebaa3d21c3d99e1558cdd6efccb9063f6c7c4dd98897fcac81_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:ebd66ac890df1a38947838966310f23d4abf4ec1769c3c207d1c31fd949b1e93_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:d4990c1d9ef8253ba76f9160f4e9d1a5b505b94fbe9bbb7ac2827c2b93937c39_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:8c33e0b35bfae6892f89a9195481cb1b2d926b9120cf9a2147e232b30dad8bd1_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:acbadc3f7ef0699e858d497acf7c8ae6d9073906f222d793a2907011066c7a16_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f6a243876322be64af0ebe46c15e9954b38e1197e185a3a75844cfb4d84bd582_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:06f651c0182b497208c809cf6f1279171e3aca0aadd62075a0aa71ad76badaae_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:9627d5a496737716241bdbdb0312fca9370f2673b0ae22bdbdd455767a3afe45_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:688d769214d9de0458152de609d1d57e89eedb1c56d75bbc8c02b1652e04767a_amd64 as a component of Migration Toolkit for Virtualization 2.11 | * |
Timeline
- Oct 15, 2026 CVE Published
- Oct 26, 2026 CVE Updated
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:83662 advisory
- https://access.redhat.com/security/cve/CVE-2026-50162 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-59887 advisory
- https://access.redhat.com/security/cve/CVE-2026-84445 advisory
- https://access.redhat.com/security/cve/CVE-2026-88031 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83662.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2499694 issue
- https://www.cve.org/CVERecord?id=CVE-2026-50162 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-50162 advisory
- https://github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2504233 issue
- https://www.cve.org/CVERecord?id=CVE-2026-56852 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56852 advisory
- https://go.dev/cl/794100 advisory
- https://go.dev/issue/80142 advisory
- https://pkg.go.dev/vuln/GO-2026-5970 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498146 issue
…and 23 more