The tar-extraction helper ensureLinkPath in oras-go validates that a hardlink's target resolves inside the extract base, but returns the original unresolved target string. For TypeLink hardlinks, os.Link() resolves relative paths against the process CWD, not the extract directory. An attacker controlling an OCI registry can craft a tarball with a hardlink entry whose relative Linkname points outside the extract directory, creating a hardlink to arbitrary files in the process CWD. Fixed in oras-go v2.6.1.