CVE-2026-55569
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry at the same archive path is opened with OpenFile using O_CREATE and O_WRONLY, which follows the attacker-planted symlink. A malicious or compromised package archive can therefore write attacker-controlled bytes outside aqua's extraction directory with the privileges of the user running aqua, potentially overwriting shell startup files, tool configuration, or writable executable paths. This issue is fixed in version 2.60.1.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.6
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
- EPSS probability
- 0.14%
- CWE
- CWE-22, CWE-59
- Published
- 2026-08-28
- Last modified
- 2026-09-01
Affected products
- aquaproj aqua
Weakness type
Related vulnerabilities
- CVE-2026-86775 — knowns before 0.30.0 Path Traversal via Document API
- CVE-2026-86099 — Chainlit through 2.12.0 Path Traversal via socket.io sessionId
- CVE-2026-78485 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-19729 — Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters
- CVE-2026-87023 — Tanium addressed a path traversal vulnerability in Comply.
- CVE-2026-87030 — Tanium addressed a path traversal vulnerability in Comply.
- CVE-2026-14505 — Tanium addressed a path traversal vulnerability in Tanium Data Service.
- CVE-2026-53581 — ntp: write path traversal