EUVD-2026-67827
GHSA-mf5c-hw34-4hpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker compromises upstream package release asset
-
DeliveryUser runs aqua install for affected tool
-
ExploitMalicious tar.gz downloaded and extracted
-
InstallSymlink entry planted pointing outside extraction directory
-
C2Subsequent same-path file write follows planted symlink
-
ExecuteTarget file (e.g., ~/.bashrc or PATH binary) overwritten with attacker payload
-
ImpactCode executed on next user login or tool invocation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker control or compromise the specific archive source that aqua downloads - a package registry entry or GitHub release asset for a tool present in the victim's aqua configuration. The user must actively run an aqua install or update operation that fetches the malicious archive (UI:R per CVSS). No special aqua configuration flag or non-default setting is required; any default aqua installation that installs from a compromised package source is affected. Exploitation is hard-bounded by the filesystem permissions of the user running aqua - privilege escalation to root is not possible unless aqua is explicitly run as root. Symlink-following semantics apply to Linux and macOS; Windows behavior is unaddressed in the advisory. Limiting factors: attacker must first achieve upstream package compromise (non-trivial supply chain step), and the user must trigger an install or update operation targeting the backdoored package. |
| Impact | The official CVSS score of 6.6 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) captures the high integrity impact, but the AV:L designation warrants scrutiny - the actual attack path is a supply chain vector where the attacker publishes or compromises a remote package source, suggesting AV:N with AC:H may better reflect operational risk. Exploitation is gated by user interaction (running |
| Exploit ScenarioDerived | An attacker who has compromised or controls an aqua-managed tool's GitHub release assets publishes a malicious tar.gz containing a symlink entry |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in pkg/unarchive/archives.go - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.
RemediationAI
Upgrade aquaproj/aqua to v2.60.1 or later, which introduces symlink target validation and a destination-jailing check in the archive extraction handler (commit d5b02b220188de376a661b3aabfa912202a1a59a; release at https://github.com/aquaproj/aqua/releases/tag/v2.60.1). If an immediate upgrade is not possible, restrict aqua to install only packages from trusted, verified sources and pin package checksums in aqua configuration - this reduces but does not eliminate the attack surface, as aqua pre-2.60.1 performs no symlink safety enforcement. Reviewing aqua registry entries for unexpected or recently modified release assets, particularly for tools not managed by established maintainers, can help detect attempts to deliver malicious archives. Running aqua under a dedicated low-privilege account with a minimal writable PATH limits the blast radius if exploitation occurs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Path Traversal via symlink following) in pkg/unarchive/archives.go's (*handler).HandleFile function within Go module github.com/aquaproj/aqua/v2. Aqua uses the github.com/mholt/archives library for archive extraction. When processing a symlink entry in a tar.gz, the handler calls os.Symlink(f.LinkTarget, dstPath) without verifying the target resolves within the extraction directory. A subsequent regular-file archive entry at the same path triggers h.fs.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY, f.Mode()), which the OS resolves by following the planted symlink, writing attacker-controlled bytes to the target outside the extraction directory. The fix in v2.60.1 (commit d5b02b220188de376a661b3aabfa912202a1a59a) introduces handleSymlink() with symlinkTargetWithinDest() validation and a withinDest() jail check applied to all archive entries before any file operation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Attacker delivers exploit via compromised remote package source (AV:N, AC:H); no victim-system privileges required; file overwrite limits confidentiality impact to low.
Primary rating from Vendor (https://github.com/aquaproj/aqua).
CVSS VectorVendor: https://github.com/aquaproj/aqua
DescriptionCVE.org
Summary
aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlink(f.LinkTarget, dstPath) without validating that the symlink target resolves inside the extraction destination. A subsequent regular-file archive entry with the same path is opened with OpenFile(dstPath, O_CREATE|O_WRONLY), which follows the attacker-planted symlink.
A malicious or compromised aqua package / release asset can therefore write attacker-controlled bytes outside aqua's extraction directory, with the privileges of the user running aqua.
Details
Affected file: pkg/unarchive/archives.go
Affected function: (*handler).HandleFile
The vulnerable logic is the combination of:
os.Symlink(f.LinkTarget, dstPath)for symlink entries, followed by:
h.fs.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY, f.Mode())for a later regular file entry at the same archive path. The symlink target is not jailed to the extraction destination, and the later file open follows the symlink.
The attached PoC uses a two-entry tar.gz archive:
- symlink
pwn -> <outside target>; - regular file
pwncontaining attacker-controlled bytes.
The same mholt/archives extraction flow is used for the vulnerable handler and for a negative-control handler using a destination-root jail.
PoC
Attachment: submission_aqua_archive_symlink_traversal_v2_final.zip
Run:
go run mkarchive.go /tmp/aqua-outside-target
go build -o aqua-archive-poc .
mkdir -p /tmp/aqua-dest
./aqua-archive-poc vuln /tmp/aqua-dest malicious.tar.gz
cat /tmp/aqua-outside-target
mkdir -p /tmp/aqua-dest-safe
./aqua-archive-poc safe /tmp/aqua-dest-safe malicious.tar.gzExpected vulnerable result:
/tmp/aqua-outside-target contains PWNED_BY_AQUA_SYMLINK_TRAVERSALExpected safe-control result:
The escaping symlink / write is rejected and the outside target is unchanged.Impact
An attacker who controls an archive that aqua installs can write attacker-controlled content to paths outside the extraction destination, limited by the filesystem permissions of the user running aqua. This can lead to user-level code execution if the overwritten path is later executed or interpreted, for example a shell startup file, a tool configuration file, or a writable PATH entry.
This report does not claim privilege escalation beyond the aqua process privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB