Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as CVE-2026-55569 (GHSA-mf5c-hw34-4hpp), is a path traversal issue in the aquaproj/aqua tool, specifically during archive extraction. The root cause is the improper handling of symbolic links and archive entry paths, allowing an attacker to write files outside the intended extraction directory.
The analysis of the provided commit d5b02b220188de376a661b3aabfa912202a1a59a clearly shows modifications to pkg/unarchive/archives.go. The handler.HandleFile method is the central point where archive entries are processed. Before the patch, this method directly created symlinks using os.Symlink(f.LinkTarget, dstPath) without validating if f.LinkTarget (the symlink's target) or dstPath (the destination for the extracted file/symlink) would escape the extraction directory. This allowed two main attack vectors:
pwn -> /etc/passwd) followed by a regular file entry with the same name (e.g., pwn). The handler.HandleFile would first create the symlink, and then when processing the regular file, it would follow the attacker-planted symlink, writing the file's content to /etc/passwd (or any other arbitrary location).../../../../etc/passwd. Without proper validation, filepath.Join(h.dest, h.normalizePath(f.NameInArchive)) might resolve to a path outside h.dest, allowing the file to be written to an arbitrary location.The patch addresses these issues by:
h.handleSymlink which calls h.symlinkTargetWithinDest to validate that the symlink target resolves within h.dest before calling os.Symlink. The original direct call to os.Symlink within HandleFile is replaced by a call to h.handleSymlink.if !h.withinDest(dstPath) at the beginning of HandleFile to ensure that the computed dstPath for any archive entry (symlink or regular file) does not escape the extraction directory. This directly mitigates the 'zip-slip' type of path traversal.Therefore, unarchive.handler.HandleFile is the primary vulnerable function because it contained the logic that directly led to both the symlink following and path traversal vulnerabilities due to a lack of proper validation. When an attacker exploits this vulnerability, the execution flow would pass through handler.HandleFile to process the malicious archive entries, making it a key runtime indicator.
unarchive.handler.HandleFilepkg/unarchive/archives.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/aquaproj/aqua/v2 | go | < 2.60.1 | 2.60.1 |