CyberRota Analysis
AI-GeneratedThe aqua command-line version manager prior to version 2.60.1 contains a vulnerability in the file handling process that allows an attacker to exploit symbolic links to write arbitrary data outside the intended extraction directory. This could lead to the overwriting of critical files, such as shell startup scripts or configuration files, with the privileges of the user running the application. Users of aqua, especially those managing sensitive environments or configurations, should prioritize upgrading to version 2.60.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry at the same archive path is opened with OpenFile using O_CREATE and O_WRONLY, which follows the attacker-planted symlink. A malicious or compromised package archive can therefore write attacker-controlled bytes outside aqua's extraction directory with the privileges of the user running aqua, potentially overwriting shell startup files, tool configuration, or writable executable paths. This issue is fixed in version 2.60.1.