qbee-io Transport up to 1.26.24 Path Validation extractTar symlink

Summaryinfo

A vulnerability identified as very critical has been detected in qbee-io Transport up to 1.26.24. Affected by this issue is the function extractTar of the component Path Validation. The manipulation leads to symlink. This vulnerability is listed as CVE-2026-55828. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in qbee-io Transport up to 1.26.24. This issue affects the function extractTar of the component Path Validation. The manipulation with an unknown input leads to a symlink vulnerability. Using CWE to declare the problem leads to CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or overwrite files one directory level above the intended extraction path. When qbee-agent performs the extraction with root privileges, this permits a root-privileged file write outside the intended destination. This issue is fixed in version 1.26.25.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-55828 since 06/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/15/2026).

Upgrading to version 1.26.25 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• qbee-io

Name

• Transport

Version

• 1.26.0
• 1.26.1
• 1.26.2
• 1.26.3
• 1.26.4
• 1.26.5
• 1.26.6
• 1.26.7
• 1.26.8
• 1.26.9
• 1.26.10
• 1.26.11
• 1.26.12
• 1.26.13
• 1.26.14
• 1.26.15
• 1.26.16
• 1.26.17
• 1.26.18
• 1.26.19
• 1.26.20
• 1.26.21
• 1.26.22
• 1.26.23
• 1.26.24

Website

• Product: https://github.com/qbee-io/transport/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion