CVE-2026-55569

3 advisories.

Go/github.com/aquaproj/aqua/v2 CVE-2026-55569: medium 6.6, EPSS 0.18%

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

Action: Upgrade github.com/aquaproj/aqua/v2 to 2.60.1 or later.

go get github.com/aquaproj/aqua/v2@v2.60.1

introduced	fixed	last affected
0	2.60.1	-

2.60.1

CVE-2026-55569 · published 2026-08-28T16:27:08Z · modified 2026-09-02T19:55:33.283638991Z · JSON

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory in github.com/aquaproj/aqua

Action: No fix published. Pin and monitor.

introduced	fixed	last affected
0	-	-

No fixed version in the source.

CVE-2026-55569 · published 2026-09-02T18:37:27Z · modified 2026-09-02T19:45:12.632796288Z · JSON

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory in github.com/aquaproj/aqua

Action: Upgrade github.com/aquaproj/aqua/v2 to 2.60.1 or later.

go get github.com/aquaproj/aqua/v2@v2.60.1

introduced	fixed	last affected
0	2.60.1	-

2.60.1

CVE-2026-55569 · published 2026-09-02T18:37:27Z · modified 2026-09-02T19:45:12.632796288Z · JSON