CVE-2026-55828 Details
Description
qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or overwrite files one directory level above the intended extraction path. When qbee-agent performs the extraction with root privileges, this permits a root-privileged file write outside the intended destination. This issue is fixed in version 1.26.25.
A path traversal vulnerability has been identified in the qbee transport library, specifically in the tar extraction routine of versions prior to 1.26.25. The vulnerability arises from a strictly lexical path validation that fails to consider on-disk symlinks created earlier in the extraction process. This oversight allows a crafted tar archive to use a symlink chain to write or overwrite files one directory level above the intended extraction path. When the qbee-agent extracts the files with root privileges, this vulnerability enables unauthorized file writes outside the designated directory.
Users should update to qbee transport version 1.26.25 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/qbee-io/transport/commit/43947671ba9be8fb08b105f3539a112ee7a57ddc | [email protected] | Source CodeVendor |
| https://github.com/qbee-io/transport/pull/19 | [email protected] | Issue TrackingVendor |
| https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| qbee-io qbee transport | < 1.26.27 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |