Description

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry at the same archive path is opened with OpenFile using O_CREATE and O_WRONLY, which follows the attacker-planted symlink. A malicious or compromised package archive can therefore write attacker-controlled bytes outside aqua's extraction directory with the privileges of the user running aqua, potentially overwriting shell startup files, tool configuration, or writable executable paths. This issue is fixed in version 2.60.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-28T20:18:29.347Z",
  "pubdate": "2026-08-28T20:18:29.347Z",
  "executiveSummary": "aqua, a declarative command-line version manager, is affected by a path traversal vulnerability that permits arbitrary file writes during the archive extraction process.\nThe vulnerability arises from an improper validation of symbolic link targets within the `pkg/unarchive/archives.go` component, specifically within the `handler.HandleFile` method.\nAn attacker can craft a malicious archive containing a symlink pointing to a sensitive location outside the intended extraction directory. Subsequent archive operations then follow this symlink, allowing the attacker to overwrite critical files, such as shell startup scripts or executable binaries, with arbitrary content.\nThe impact is significant, as the arbitrary file write occurs with the privileges of the user executing the aqua command. This could lead to local privilege escalation or the execution of arbitrary code if an attacker overwrites executable files or configuration scripts. Exploitation requires the user to extract a malicious or compromised package archive using affected versions of aqua prior to 2.60.1. No authentication is required for the extraction process itself, though it relies on the user processing a tainted archive file.",
  "technicalDetails": "The vulnerability originates in `pkg/unarchive/archives.go` within the `handler.HandleFile` method of the aqua version manager. The logic fails to implement secure path sanitization when processing archive entries, specifically those designated as symbolic links.\nThe root cause is a lack of validation regarding the `archives.FileInfo.LinkTarget` attribute. When the application encounters a symlink entry in an archive, it invokes `os.Symlink` using the attacker-provided target without verifying if the resolved path remains within the application's designated extraction root. This failure to enforce a jail or canonicalize the path allows for directory traversal via symbolic links.\nThe attack flow proceeds in two distinct phases: First, an attacker includes a symlink entry in a package archive that points to a sensitive target on the host filesystem (e.g., `~/.bashrc`, `~/.ssh/authorized_keys`, or binaries in a user's PATH). Second, the attacker includes a regular-file entry in the same archive that shares the same relative path as the previously planted symlink.\nWhen aqua processes the archive, the `handler.HandleFile` method creates the malicious symlink. Subsequently, when the archive extractor reaches the regular file entry, it utilizes `os.OpenFile` with the `O_CREATE` and `O_WRONLY` flags. Because the target path is now a symlink pointing outside the extraction directory, the operating system follows the link, causing `os.OpenFile` to open the destination file defined by the attacker.\nThe application then proceeds to write the contents of the regular-file archive entry into the target file. Since this operation is performed with the privileges of the user invoking aqua, the attacker effectively achieves an arbitrary file write. This leads to post-exploitation scenarios where an attacker can replace legitimate configuration files or system executables with malicious payloads. If the attacker can influence the contents written to these files, they may achieve arbitrary code execution upon the next login or when the affected tool or script is executed by the victim."
}