{"id":"GHSA-mf5c-hw34-4hpp","summary":"Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory","details":"### Summary\n\n`aquaproj/aqua` extracts downloaded tool archives through `pkg/unarchive/archives.go` using `github.com/mholt/archives`. The archive handler creates symlink entries with `os.Symlink(f.LinkTarget, dstPath)` without validating that the symlink target resolves inside the extraction destination. A subsequent regular-file archive entry with the same path is opened with `OpenFile(dstPath, O_CREATE|O_WRONLY)`, which follows the attacker-planted symlink.\n\nA malicious or compromised aqua package / release asset can therefore write attacker-controlled bytes outside aqua's extraction directory, with the privileges of the user running aqua.\n\n### Details\n\nAffected file: `pkg/unarchive/archives.go`\n\nAffected function: `(*handler).HandleFile`\n\nThe vulnerable logic is the combination of:\n\n```go\nos.Symlink(f.LinkTarget, dstPath)\n```\n\nfor symlink entries, followed by:\n\n```go\nh.fs.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY, f.Mode())\n```\n\nfor a later regular file entry at the same archive path. The symlink target is not jailed to the extraction destination, and the later file open follows the symlink.\n\nThe attached PoC uses a two-entry `tar.gz` archive:\n\n1. symlink `pwn -\u003e \u003coutside target\u003e`;\n2. regular file `pwn` containing attacker-controlled bytes.\n\nThe same `mholt/archives` extraction flow is used for the vulnerable handler and for a negative-control handler using a destination-root jail.\n\n### PoC\n\nAttachment: `submission_aqua_archive_symlink_traversal_v2_final.zip`\n\nRun:\n\n```bash\ngo run mkarchive.go /tmp/aqua-outside-target\ngo build -o aqua-archive-poc .\nmkdir -p /tmp/aqua-dest\n./aqua-archive-poc vuln /tmp/aqua-dest malicious.tar.gz\ncat /tmp/aqua-outside-target\n\nmkdir -p /tmp/aqua-dest-safe\n./aqua-archive-poc safe /tmp/aqua-dest-safe malicious.tar.gz\n```\n\nExpected vulnerable result:\n\n```text\n/tmp/aqua-outside-target contains PWNED_BY_AQUA_SYMLINK_TRAVERSAL\n```\n\nExpected safe-control result:\n\n```text\nThe escaping symlink / write is rejected and the outside target is unchanged.\n```\n\n### Impact\n\nAn attacker who controls an archive that aqua installs can write attacker-controlled content to paths outside the extraction destination, limited by the filesystem permissions of the user running aqua. This can lead to user-level code execution if the overwritten path is later executed or interpreted, for example a shell startup file, a tool configuration file, or a writable PATH entry.\n\nThis report does not claim privilege escalation beyond the aqua process privileges.","aliases":["CVE-2026-55569","GO-2026-6314"],"modified":"2026-09-02T19:55:33.283638991Z","published":"2026-08-28T16:27:08Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-28T16:27:08Z","nvd_published_at":null,"cwe_ids":["CWE-22","CWE-59"]},"references":[{"type":"WEB","url":"https://github.com/aquaproj/aqua/security/advisories/GHSA-mf5c-hw34-4hpp"},{"type":"WEB","url":"https://github.com/aquaproj/aqua/commit/d5b02b220188de376a661b3aabfa912202a1a59a"},{"type":"PACKAGE","url":"https://github.com/aquaproj/aqua"},{"type":"WEB","url":"https://github.com/aquaproj/aqua/releases/tag/v2.60.1"}],"affected":[{"package":{"name":"github.com/aquaproj/aqua/v2","ecosystem":"Go","purl":"pkg:golang/github.com/aquaproj/aqua/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.60.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mf5c-hw34-4hpp/GHSA-mf5c-hw34-4hpp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L"}]}