CVE-2026-55569: aqua Path Traversal Vulnerability

CVE-2026-55569 Overview

CVE-2026-55569 is a path traversal vulnerability [CWE-22] in aqua, a declarative command-line version manager written in Go. Versions prior to 2.60.1 fail to validate symbolic link targets during archive extraction. The handler.HandleFile method in pkg/unarchive/archives.go calls os.Symlink using archives.FileInfo.LinkTarget without verifying that the target stays within the extraction destination. A subsequent regular-file entry at the same archive path is then opened with OpenFile using O_CREATE and O_WRONLY, which follows the attacker-planted symlink. A malicious package archive can write attacker-controlled bytes anywhere the aqua user can write. Version 2.60.1 fixes the flaw.

Critical Impact
A crafted archive processed by aqua can overwrite files outside the extraction directory, including shell startup files, tool configuration, and writable executable paths, leading to local code execution as the invoking user.

Affected Products

aqua (aquaproj/aqua) versions prior to 2.60.1
pkg/unarchive/archives.go archive extraction handler
Any environment (CI runners, developer workstations) using aqua to install tools

Discovery Timeline

2026-08-28 - CVE-2026-55569 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-55569

Vulnerability Analysis

Aqua extracts package archives during tool installation. The extraction logic in pkg/unarchive/archives.go processes archive entries sequentially. When the handler encounters a symbolic link entry, it calls os.Symlink(linkTarget, destPath) without confirming that linkTarget resolves inside the extraction root. An attacker can craft an archive that first declares a symlink named config.yaml pointing to ../../../.bashrc, then declares a regular file entry also named config.yaml.

When aqua processes the second entry, it invokes os.OpenFile with O_CREATE|O_WRONLY. Because the path already exists as a symlink, OpenFile follows it and truncates the target outside the extraction directory. Writes proceed with the privileges of the user running aqua. This chained symlink-then-write pattern is a classic archive extraction weakness catalogued under [CWE-22] path traversal.

Root Cause

The root cause is missing containment validation on symlink targets before creation. The handler trusts archive-supplied LinkTarget values and does not resolve them against the extraction destination. Any relative path traversal sequence in LinkTarget escapes the intended sandbox.

Attack Vector

Exploitation requires the victim to run aqua against a malicious or compromised package archive. This can occur through a poisoned registry entry, a compromised upstream release asset, or a supply-chain substitution attack. User interaction is required because the victim must trigger the install. Successful exploitation lets the attacker overwrite ~/.bashrc, ~/.zshrc, editor init files, or binaries in writable PATH directories, enabling local code execution on the next shell session or tool invocation.

// Patch context from pkg/unarchive/archives.go
import (
    "context"
    "errors"
    "fmt"
    "io"
    "log/slog"
)
// Source: https://github.com/aquaproj/aqua/commit/d5b02b220188de376a661b3aabfa912202a1a59a
// The fix adds validation that symlink targets and file paths
// remain confined to the extraction destination directory.

Detection Methods for CVE-2026-55569

Indicators of Compromise

Unexpected modifications to shell startup files (~/.bashrc, ~/.zshrc, ~/.profile) shortly after aqua invocations
Symbolic links inside aqua extraction directories whose targets resolve outside the extraction root
Newly written or overwritten executables in user-writable PATH directories after a package install
aqua installing packages sourced from unfamiliar or recently modified registries

Detection Strategies

File integrity monitoring on shell profile files and user-writable executable directories on developer workstations and CI runners
Audit logging of aqua install and aqua i invocations correlated with subsequent file writes outside ~/.local/share/aquaproj-aqua
Static inspection of archives referenced by aqua registries for entries containing .. in LinkTarget fields

Monitoring Recommendations

Track the aqua binary version in use across endpoints and CI environments and alert on versions below 2.60.1
Monitor process telemetry for aqua spawning writes to paths outside its data directory
Alert on shell configuration file modifications performed by non-interactive processes

How to Mitigate CVE-2026-55569

Immediate Actions Required

Upgrade aqua to version 2.60.1 or later on all developer workstations, build agents, and CI/CD runners
Audit aqua registries and pinned packages for entries sourced from untrusted or unverified publishers
Review shell startup files and writable PATH directories for unauthorized modifications made since aqua was last run

Patch Information

The fix is available in aqua v2.60.1. See the GitHub Security Advisory GHSA-mf5c-hw34-4hpp, the GitHub Release v2.60.1, and the remediation commit for details. The patch adds validation to ensure symlink targets and file paths remain within the extraction destination.

Workarounds

Restrict aqua execution to trusted registries and pinned package checksums until the upgrade is deployed
Run aqua inside an ephemeral, unprivileged container or sandbox so extraction cannot reach persistent host paths
Disable automatic installation of packages from third-party or community registries

bash

# Upgrade aqua to the patched release
aqua update-aqua
aqua --version   # verify 2.60.1 or later

# Alternative: reinstall via the official installer
curl -sSfL https://raw.githubusercontent.com/aquaproj/aqua-installer/main/aqua-installer | bash