THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-mf5c-hw34-4hpp (medium) — Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

[GHSA] GHSA-mf5c-hw34-4hpp (medium) — Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

medgithub_advisoriesPublished 2026-08-28

GHSA-mf5c-hw34-4hpp Severity: medium CVE: CVE-2026-55569

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

### Summary

`aquaproj/aqua` extracts downloaded tool archives through `pkg/unarchive/archives.go` using `github.com/mholt/archives`. The archive handler creates symlink entries with `os.Symlink(f.LinkTarget, dstPath)` without validat

Indicators of compromise

Original source: https://github.com/advisories/GHSA-mf5c-hw34-4hpp