Executive brief
Aqua is a popular package manager for installing tools from pre-built archives. When Aqua extracts downloaded archives, it does not properly validate symlinks before writing files. An attacker who controls a malicious archive can exploit this to write files anywhere on the filesystem that the user running Aqua has permission to access. If the attacker writes to executable locations, shell startup scripts, or tool configuration files, they could achieve code execution with the same privileges as the user.
Technical details
The vulnerability is a path traversal (CWE-22) combined with unsafe symlink following (CWE-59) in `pkg/unarchive/archives.go`. The archive handler extracts symlink entries via `os.Symlink(f.LinkTarget, dstPath)` without validating that the link target resolves within the extraction destination. A subsequent regular-file entry with the same path is opened via `OpenFile(dstPath, os.O_CREATE|os.O_WRONLY)`, which follows the attacker-planted symlink to the external target. The attack requires the archive to be extracted and the user to run Aqua on a malicious or compromised release asset. An attacker can write arbitrary content with the privileges of the user running Aqua, potentially leading to code execution if the overwritten file is later executed or interpreted. The fix is available in version 2.60.1 and later, which implements proper destination-root jailing for extracted paths.
Affected products
- aquaproj aqua < 2.60.1
Timeline
- 2026-06-16: disclosed: Published to GitHub Advisory Database
- 2026-08-28: advisory: GitHub Advisory updated
- 2026-06-16: patched: Fixed in version 2.60.1