Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-55828qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

Medium 6.0

In plain English

A medium-severity path traversal in transport from qbee-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.4%top 68.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or overwrite files one directory level above the intended extraction path. When qbee-agent performs the extraction with root privileges, this permits a root-privileged file write outside the intended destination. This issue is fixed in version 1.26.25.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	go.qbee.io/transport	1.26.25	GHSA-f9m7-vc86-p6jj
Go	go.qbee.io/transport	1.26.25	GO-2026-5352

Affected products (as reported)

Vendor	Product	Versions
qbee-io	transport	< 1.26.25

Weakness: CWE-22, CWE-59 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj x_refsource_CONFIRM
https://github.com/qbee-io/transport/pull/19 x_refsource_MISC
https://github.com/qbee-io/transport/commit/43947671ba9be8fb08b105f3539a112ee7a57ddc x_refsource_MISC