PT-2026-51115 · Go · Go.Qbee.Io/Transport

Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2026-55828

OSV

CVSS v4.0

6.0

Média

Vetor base

AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Impact

The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library's path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive can be used to write or overwrite files one directory level above the intended extraction path. In the case of qbee-agent, which runs with root privileges, this vulnerability permits a root-privileged file write outside the intended destination.

Patches

The issue has been addressed in version v1.26.25

Correção

Path traversal

Link Following

Enumeração de Fraquezas

CWE-22

CWE-59

Identificadores relacionados

CVE-2026-55828

GHSA-F9M7-VC86-P6JJ

Produtos afetados

Go.Qbee.Io/Transport

Referências · 3

• https://github.com/qbee-io/transport · Nota
• https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj · Nota
• https://osv.dev/vulnerability/GHSA-f9m7-vc86-p6jj · Aviso do Fabricante