Go/go.qbee.io/transport CVE-2026-55828: unknown, EPSS 0.38%

go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)

Action: Upgrade go.qbee.io/transport to 1.26.25 or later.

go get go.qbee.io/transport@v1.26.25

Affected

Fixed versions

Sources

• osv: GO-2026-5352
• https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj

CVE-2026-55828 · published 2026-06-25T18:43:19Z · modified 2026-06-25T19:45:18.161173340Z · JSON