CVE-2026-55828

Name of the Vulnerable Software and Affected Versions go.qbee.io/transport versions prior to v1.26.25

Description The extractTar routine in the go.qbee.io/transport library contains a symlink-chain path traversal issue. Because path validation is strictly lexical and does not account for on-disk symlinks created during extraction, a specially crafted tar archive can be used to write or overwrite files one directory level above the intended destination. When used by the qbee-agent, which operates with root privileges, this allows for root-privileged file writes outside the designated path.

Recommendations Update go.qbee.io/transport to version v1.26.25.