GitHub Advisoryadvisory · Go

GHSA-f9m7-vc86-p6jj go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)

MEDIUM Published 2026-06-19 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-55828
Ecosystem
Go
Packages
go.qbee.io/transport
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-22, CWE-59
Reviewed
2026-06-19

Affected packages

• Go go.qbee.io/transport: < 1.26.25 → fixed in 1.26.25

Description

Impact The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library's path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive can be used to write or overwrite files one directory level above the intended extraction path. In the case of qbee-agent, which runs with root privileges, this vulnerability permits a root-privileged file write outside the intended destination. Patches The issue has been addressed in version v1.26.25

Related

Alias · CVE (1)

  • CVE-2026-55828 qbee transport is a remote access transport protocol implementation. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References