{"cve":"CVE-2026-55828","nvd":{"published":"2026-09-15T16:17:16.367","modified":"2026-09-30T17:51:56.193","status":"Deferred","description":"qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or overwrite files one directory level above the intended extraction path. When qbee-agent performs the extraction with root privileges, this permits a root-privileged file write outside the intended destination. This issue is fixed in version 1.26.25.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","score":6.0},"cvss_v3":null,"cwes":["CWE-22","CWE-59"],"references":["https://github.com/qbee-io/transport/commit/43947671ba9be8fb08b105f3539a112ee7a57ddc","https://github.com/qbee-io/transport/pull/19","https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-55828","score":0.00375,"percentile":0.31166,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-f9m7-vc86-p6jj","url":"https://osv.dev/vulnerability/GHSA-f9m7-vc86-p6jj","summary":"go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)","modified":"2026-06-25T19:56:16.807337495Z","packages":[{"ecosystem":"Go","name":"go.qbee.io/transport","purl":"pkg:golang/go.qbee.io/transport","ranges":["<1.26.25"],"fixed":["1.26.25"]}]},{"id":"GO-2026-5352","url":"https://osv.dev/vulnerability/GO-2026-5352","summary":"go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)","modified":"2026-06-25T19:45:18.161173340Z","packages":[{"ecosystem":"Go","name":"go.qbee.io/transport","purl":"pkg:golang/go.qbee.io/transport","ranges":["<1.26.25"],"fixed":["1.26.25"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}