CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)
Attackers can exploit symlink chains in tar extraction to write files outside the destination, potentially gaining root privileges in qbee-agent.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55828?
CVE-2026-55828 is a medium-severity path traversal vulnerability in qbee-io transport, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or overwrite files one directory level above the intended extraction path. When qbee-agent performs the extraction with root privileges, this permits a root-privileged file write outside the intended destination. This issue is fixed in version 1.26.25.
Which versions are affected by CVE-2026-55828?
3 open source packages ship an affected version, including go.qbee.io/transport.
| Package | Affected | Fixed in |
|---|---|---|
go.qbee.io/transport Go | All versions | 1.26.25 |
go.qbee.io/transport Go | All versions | 1.26.25 |
go.qbee.io/transport Go | All versions | 1.26.25 |
How do I fix CVE-2026-55828?
Upgrade go.qbee.io/transport to 1.26.25 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55828 being exploited?
There is no known exploitation of CVE-2026-55828 in the wild and no public exploit code.
Sources
Also known as GHSA-f9m7-vc86-p6jj, GO-2026-5352.