CVE-2026-50162 | oras-project oras-go up to 2.6.0 File Path Resolver content/file/file.go resolveWritePath AnnotationTitle symlink (Nessus ID 327787)

A vulnerability, which was classified as . This affects the function resolveWritePath of the file content/file/file.go of the component File Path Resolver. Executing a manipulation of the argument AnnotationTitle can lead to symlink following.

This vulnerability appears as CVE-2026-50162. The attack may be performed from remote. There is no available exploit.