THREAT OPS › Threat News › [GHSA] GHSA-mf5c-hw34-4hpp (medium) — Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory
[GHSA] GHSA-mf5c-hw34-4hpp (medium) — Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory
GHSA-mf5c-hw34-4hpp Severity: medium CVE: CVE-2026-55569
Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory
### Summary
`aquaproj/aqua` extracts downloaded tool archives through `pkg/unarchive/archives.go` using `github.com/mholt/archives`. The archive handler creates symlink entries with `os.Symlink(f.LinkTarget, dstPath)` without validat
Indicators of compromise
- CVE-2026-55569cve
Original source: https://github.com/advisories/GHSA-mf5c-hw34-4hpp