https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:15:36 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-55828 <p>qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or overwrite files one directory level above the intended extraction path. When qbee-agent performs the extraction with root privileges, this permits a root-privileged file write outside the intended destination. This issue is fixed in version 1.26.25.</p> <p>qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or overwrite files one directory level above the intended extraction path. When qbee-agent performs the extraction with root privileges, this permits a root-privileged file write outside the intended destination. This issue is fixed in version 1.26.25.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-55828 https://vulnerability.circl.lu/vuln/ghsa-f9m7-vc86-p6jj <p><strong>Affected:</strong> Go: go.qbee.io/transport</p> <p>### Impact</p> <p>The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library&#39;s path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive can be used to write or overwrite files one directory level above the intended extraction path. In the case of qbee-agent, which runs with root privileges, this vulnerability permits a root-privileged file write outside the intended destination.</p> <p>### Patches</p> <p>The issue has been addressed in version v1.26.25</p> <p><strong>Affected:</strong> Go: go.qbee.io/transport</p> <p>### Impact</p> <p>The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library&#39;s path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive can be used to write or overwrite files one directory level above the intended extraction path. In the case of qbee-agent, which runs with root privileges, this vulnerability permits a root-privileged file write outside the intended destination.</p> <p>### Patches</p> <p>The issue has been addressed in version v1.26.25</p> https://vulnerability.circl.lu/vuln/ghsa-f9m7-vc86-p6jj