https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T20:15:34.853170+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-55828 fkie_cve-2026-55828 2026-10-02T20:15:35.144942+00:00

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or overwrite files one directory level above the intended extraction path. When qbee-agent performs the extraction with root privileges, this permits a root-privileged file write outside the intended destination. This issue is fixed in version 1.26.25.

 https://vulnerability.circl.lu/vuln/ghsa-f9m7-vc86-p6jj GHSA-f9m7-vc86-p6jj — go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination) 2026-10-02T20:15:35.145067+00:00

Affected: Go: go.qbee.io/transport

### Impact

The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library's path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive can be used to write or overwrite files one directory level above the intended extraction path. In the case of qbee-agent, which runs with root privileges, this vulnerability permits a root-privileged file write outside the intended destination.

### Patches

The issue has been addressed in version v1.26.25