oras-go content/file.Store layer extraction mishandles symlink chains: pushDir via extractTarDirectory/ensureLinkPath performs lexical checks, resolveRelToBase skips parent-symlink walk for root entries, and writeFile follows a terminal symlink, enabling writes outside the store root even with AllowPathTraversalOnWrite=false. Affects oras-go < 2.6.2. Upgrade to 2.6.2 to mitigate.