GHSA-f9m7-vc86-p6jj
go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | go.qbee.io/transport | < 1.26.25 | 1.26.25 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library's path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive can be used to write or overwrite files one directory level above the intended extraction path. In the case of qbee-agent, which runs with root privileges, this vulnerability permits a root-privileged file write outside the intended destination.
### Patches
The issue has been addressed in version v1.26.25
References
External links from the advisory. They lead to third-party sites.