{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/aquaproj/aqua/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.60.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55569"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T16:27:08Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`aquaproj/aqua` extracts downloaded tool archives through `pkg/unarchive/archives.go` using `github.com/mholt/archives`. The archive handler creates symlink entries with `os.Symlink(f.LinkTarget, dstPath)` without validating that the symlink target resolves inside the extraction destination. A subsequent regular-file archive entry with the same path is opened with `OpenFile(dstPath, O_CREATE|O_WRONLY)`, which follows the attacker-planted symlink.\n\nA malicious or compromised aqua package / release asset can therefore write attacker-controlled bytes outside aqua\u0027s extraction directory, with the privileges of the user running aqua.\n\n### Details\n\nAffected file: `pkg/unarchive/archives.go`\n\nAffected function: `(*handler).HandleFile`\n\nThe vulnerable logic is the combination of:\n\n```go\nos.Symlink(f.LinkTarget, dstPath)\n```\n\nfor symlink entries, followed by:\n\n```go\nh.fs.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY, f.Mode())\n```\n\nfor a later regular file entry at the same archive path. The symlink target is not jailed to the extraction destination, and the later file open follows the symlink.\n\nThe attached PoC uses a two-entry `tar.gz` archive:\n\n1. symlink `pwn -\u003e \u003coutside target\u003e`;\n2. regular file `pwn` containing attacker-controlled bytes.\n\nThe same `mholt/archives` extraction flow is used for the vulnerable handler and for a negative-control handler using a destination-root jail.\n\n### PoC\n\nAttachment: `submission_aqua_archive_symlink_traversal_v2_final.zip`\n\nRun:\n\n```bash\ngo run mkarchive.go /tmp/aqua-outside-target\ngo build -o aqua-archive-poc .\nmkdir -p /tmp/aqua-dest\n./aqua-archive-poc vuln /tmp/aqua-dest malicious.tar.gz\ncat /tmp/aqua-outside-target\n\nmkdir -p /tmp/aqua-dest-safe\n./aqua-archive-poc safe /tmp/aqua-dest-safe malicious.tar.gz\n```\n\nExpected vulnerable result:\n\n```text\n/tmp/aqua-outside-target contains PWNED_BY_AQUA_SYMLINK_TRAVERSAL\n```\n\nExpected safe-control result:\n\n```text\nThe escaping symlink / write is rejected and the outside target is unchanged.\n```\n\n### Impact\n\nAn attacker who controls an archive that aqua installs can write attacker-controlled content to paths outside the extraction destination, limited by the filesystem permissions of the user running aqua. This can lead to user-level code execution if the overwritten path is later executed or interpreted, for example a shell startup file, a tool configuration file, or a writable PATH entry.\n\nThis report does not claim privilege escalation beyond the aqua process privileges.",
  "id": "GHSA-mf5c-hw34-4hpp",
  "modified": "2026-08-28T16:27:08Z",
  "published": "2026-08-28T16:27:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aquaproj/aqua/security/advisories/GHSA-mf5c-hw34-4hpp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aquaproj/aqua/commit/d5b02b220188de376a661b3aabfa912202a1a59a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aquaproj/aqua"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aquaproj/aqua/releases/tag/v2.60.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Aqua\u0027s archive extraction follows attacker-planted symlinks, allowing writes outside the install directory"
}