CVE-2026-55569: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in aquaproj aqua

In aqua versions before 2.60.1, the handler.HandleFile method calls os.Symlink with the LinkTarget from an archive without verifying that the target path is confined to the extraction directory. Subsequently, a regular file entry at the same archive path is opened with O_CREATE and O_WRONLY flags, which follows the attacker-planted symlink. This allows an attacker to write arbitrary files outside the intended extraction directory, leading to potential privilege escalation or system compromise. The vulnerability is categorized under CWE-22 (Path Traversal) and CWE-59 (Link Following).

An attacker who can supply a malicious or compromised package archive can cause aqua to write files outside its extraction directory with the privileges of the user running aqua. This can lead to overwriting critical files such as shell startup files, tool configuration files, or writable executable paths, potentially resulting in privilege escalation or persistent compromise of the user's environment.

This vulnerability is fixed in aqua version 2.60.1. Users should upgrade to version 2.60.1 or later to remediate this issue. No other mitigation or temporary workaround is indicated in the available data.