CVE-2026-55569 in aqua
Summary
by MITRE • 08/28/2026
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry at the same archive path is opened with OpenFile using O_CREATE and O_WRONLY, which follows the attacker-planted symlink. A malicious or compromised package archive can therefore write attacker-controlled bytes outside aqua's extraction directory with the privileges of the user running aqua, potentially overwriting shell startup files, tool configuration, or writable executable paths. This issue is fixed in version 2.60.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Aqua, a declarative command-line version manager written in Go, represents a critical path traversal and symlink following flaw within its archive extraction logic. Specifically, the defect resides in the pkg/unarchive/archives.go file, inside the handler.HandleFile method. The core technical issue arises from how the software handles symbolic links during the unpacking of package archives. When processing an archive entry that is identified as a symbolic link, Aqua invokes the os.Symlink function to create the link on the local filesystem using the LinkTarget specified in the archives.FileInfo structure. Crucially, prior to version 2.60.1, this operation lacks sufficient validation to ensure that the target path of the symlink remains strictly within the designated extraction destination directory. This absence of a chroot-like containment or strict path canonicalization check allows an attacker to craft archive files containing symbolic links with absolute paths or relative paths that escape the intended sandboxed environment.
The operational impact is exacerbated by the subsequent handling of regular file entries in the same archive. When Aqua encounters a standard file entry at a path that corresponds to one previously created as a symlink, it opens the file using OpenFile with flags O_CREATE and O_WRONLY. Because these flags do not prevent following existing symlinks on many operating systems, the write operation is directed through the maliciously planted symbolic link rather than creating a new file within the safe extraction directory. This mechanism effectively allows an attacker to redirect writes from the archive contents to arbitrary locations on the host system where the user running Aqua has write permissions. The severity of this vulnerability lies in its potential for privilege escalation and system compromise, as it enables remote code execution or configuration tampering without requiring elevated privileges beyond those of the current user.
This flaw aligns with CWE-59 Improper Link Resolution Before File Access, commonly known as a symlink race condition or path traversal via symbolic links. It also maps to MITRE ATT&CK techniques related to Defense Evasion and Persistence, specifically T1036 (Masquerading) if used to disguise malicious files, or more directly T1548 (Abuse Elevation Control Mechanism) if the overwritten paths include shell startup scripts like .bashrc or .zshrc. By overwriting these configuration files, an attacker can establish persistence by injecting commands that execute upon every new terminal session. Furthermore, targeting writable executable paths could allow for binary planting attacks, where a malicious version of a trusted utility is placed in a directory earlier in the system PATH than the legitimate one, leading to arbitrary code execution whenever the user invokes that tool.
The consequences extend beyond simple file overwriting. If shell startup files are compromised, an attacker can exfiltrate sensitive data such as environment variables containing API keys or tokens stored by Aqua itself. Additionally, modifying configuration files for other tools managed by Aqua could disrupt service availability or introduce backdoors into development workflows. Since Aqua is often used in CI/CD pipelines and developer environments where trust boundaries may be looser than in production servers, the risk of supply chain compromise through malicious package archives is significant. An attacker who controls a compromised registry or injects malware into a popular library could distribute an archive that exploits this vulnerability to gain persistent access to multiple machines running Aqua with outdated versions.
Mitigation for this issue requires immediate upgrading to version 2.60.1, which implements the necessary validation checks to ensure symlink targets remain within the extraction directory. For organizations unable to upgrade immediately due to dependency constraints, defensive measures include enforcing strict file integrity monitoring on critical system directories such as home shell configuration files and standard binary paths like /usr/bin or local bin directories. Security teams should also audit their CI/CD pipelines for any custom archive processing logic that might replicate this vulnerability pattern if they have forked or modified Aqua’s extraction components. Furthermore, adopting the principle of least privilege by running automation tasks under dedicated service accounts with restricted write permissions can limit the blast radius even if a symlink traversal occurs. Regular scanning of package archives against known malicious patterns and validating source integrity through cryptographic signatures are also essential practices to prevent such attacks at the supply chain level.