Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

go.qbee.io/transport

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.0GoPublished

    go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)

    CVE-2026-55828 · GHSA-f9m7-vc86-p6jj

    Affected
    • Go go.qbee.io/transport < 1.26.25
    Fixed in
    1.26.25· Vendor fix available
    Issue
    Impact The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library's path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive can be used to write or overwrite files one directory level above the intended extraction path. In the case of qbee-agent, which runs with root privileges, this vulnerability permits a root-privileged file write outside the intended destination. Patches The issue has been addressed in version v1.26.25

    Recommended action: Upgrade to 1.26.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →