CVE-2026-55828: qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path val

Executive brief

The qbee-io transport library, used for data movement in qbee-agent, contains a flaw in how it handles compressed archive files. An attacker can provide a specially crafted archive that, when extracted, writes files to unauthorized locations on the system. Because the software often runs with high system privileges, this could allow an attacker to overwrite critical system files, potentially leading to full system compromise or service disruption.

Technical details

A path traversal vulnerability exists in the extractTar routine of the go.qbee.io/transport library. The root cause is that path validation is performed strictly lexically and does not account for on-disk symlinks created during the extraction process. An attacker can craft a tar archive containing a symlink followed by a file that uses that symlink to escape the destination directory. In implementations like qbee-agent, which runs as root, this allows for arbitrary file writes with root privileges. The issue is fixed in version 1.26.25.

Affected products

• qbee-io transport < 1.26.25

Timeline

• 2026-06-16: disclosed: Initial report to qbee-io/transport
• 2026-06-19: advisory: GitHub Advisory published
• 2026-06-19: patched: Version 1.26.25 released

References

• https://api.github.com/users/ttzero25
• https://github.com/ttzero25
• https://api.github.com/users/ttzero25/gists%7B/gist_id%7D
• https://api.github.com/users/ttzero25/repos
• https://avatars.githubusercontent.com/u/145201104?v=4
• https://api.github.com/users/ttzero25/events%7B/privacy%7D