Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

Summary

aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlink(f.LinkTarget, dstPath) without validating that the symlink target resolves inside the extraction destination. A subsequent regular-file archive entry with the same path is opened with OpenFile(dstPath, O_CREATE|O_WRONLY), which follows the attacker-planted symlink.

A malicious or compromised aqua package / release asset can therefore write attacker-controlled bytes outside aqua's extraction directory, with the privileges of the user running aqua.

Details

Affected file: pkg/unarchive/archives.go

Affected function: (*handler).HandleFile

The vulnerable logic is the combination of:

os.Symlink(f.LinkTarget, dstPath)