land.oras/oras-java-sdk vulnerabilities

Latest land.oras/oras-java-sdk CVEs

Newest publication first

1. GHSA-j6hm-v3x2-qv6j land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

   Published 2026-07-01

   None·CVSS 0.0

   Summary ArchiveUtils.untar(InputStream, Path) and ArchiveUtils.unzip(InputStream, Path) in land.oras:oras-java-sdk create symbolic-link entries from an archive without validating the symlink target. A malicious tar (or zip) shipped as an OCI layer blob can place a symlink under t...

2. GHSA-xm96-gfjx-jcrc ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

   Published 2026-05-19

   High·CVSS 8.1

   Summary The pullArtifact methods in Registry and OCILayout use the org.opencontainers.image.title annotation from a pulled manifest as a filename, resolving it against the caller supplied output directory without normalization or a containment check. A manifest publisher can set...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.