VDB
RHSA-2026:83663
RHSA-2026:83663
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link (symlink) traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside the intended working directory. This filesystem boundary bypass allows for arbitrary file creation, potentially leading to unauthorized data modification or system compromise depending on the runtime environment.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:3535fe7d87872ca3ec41a0eccb05f66b84f05e33044ab182398997465e95007b_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:87fb394733eabb821d8be779316e5225d45cf9ce4f09225a7c203f2a14d6385c_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:057f4104612a3923c224c14e0b4d4a65130d71098fdfcb1f0144ccb9670f75c5_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:df61f9084cb325db0dc5b38628fa0f06a958d4951714775e2cecfa041d1bb225_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:a5fabf9832c0dda8be34e43f49284f5b6c1c7bbb5ad75d89b7331c3a8d598a95_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:37fe0eff444c0b4ef70c9aefb836d9d412b68aecc3050574768b2f376c971be8_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:e3d35ef0434fa976a2f6a8c910391d669fa145ad67e2ca36d281497d088a8d8f_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:77c123b144057c5a08d4d11eda84478706bd11ef4a8a1115e7d617a14827be67_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:2ec931bab5cce67a24f7f55536b090e91ce8f13bda3fe7324b133cc35f682fa9_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:057bf56acae27a2a7c4fbb9ebd2857b932d9324b2002cab41f21f2931431a098_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:3f7320158484a43b3576a675be4decb5d16e2a43287fa97bcf4717cedc32d2ed_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:292fc6d7fbb4d2d77dac30784303a4d2f782795416b68259cfd772d9e3d518f6_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:a971c06918017c4b36f6f1f3dbff8a61d336b68b9dac22a124a757ae45f809fc_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:a8cea4674182c181ac918ebb74ada1a3029c8c75d844e1a022ca583ca5ca9e44_amd64 as a component of Migration Toolkit for Virtualization 2.10 | * |
Timeline
- Oct 15, 2026 CVE Published
- Oct 26, 2026 CVE Updated
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:83663 advisory
- https://access.redhat.com/security/cve/CVE-2026-50162 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-59887 advisory
- https://access.redhat.com/security/cve/CVE-2026-84445 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83663.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2499694 issue
- https://www.cve.org/CVERecord?id=CVE-2026-50162 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-50162 advisory
- https://github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2504233 issue
- https://www.cve.org/CVERecord?id=CVE-2026-56852 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56852 advisory
- https://go.dev/cl/794100 advisory
- https://go.dev/issue/80142 advisory
- https://pkg.go.dev/vuln/GO-2026-5970 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498146 issue
- https://www.cve.org/CVERecord?id=CVE-2026-59887 advisory
…and 17 more