qbee-io vulnerabilities

Products

• transport 1

Latest qbee-io CVEs

Newest publication first

1. CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

   Published 2026-09-15

   Medium·CVSS 6.0 EPSS 0.38%

   qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.