Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| go.qbee.io/transport | go | < 1.26.25 | 1.26.25 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55828, describes a symlink-chain path traversal in the extractTar routine of the qbee-io/transport library. The core issue was that the extraction process, specifically when writing files, did not properly handle on-disk symlinks created earlier in the archive. This allowed a malicious tar archive to trick the system into writing files one directory level above the intended destination.
Analysis of the provided commit 43947671ba9be8fb08b105f3539a112ee7a57ddc reveals changes in file_transfer.go and file_transfer_test.go.
transport.extractFile: The most direct fix was applied to the extractFile function. This function is responsible for opening and writing the contents of individual files from the tar archive. The original implementation used os.OpenFile without os.O_EXCL, meaning it could overwrite existing files or follow existing symlinks. The patch addresses this by first calling os.Remove(targetPath) to ensure any existing entry (including a malicious symlink) is removed, and then using os.O_CREATE|os.O_EXCL with os.OpenFile. The os.O_EXCL flag ensures that the file is created exclusively, preventing the function from following a pre-existing symlink to an unintended location. This change directly mitigates the path traversal vulnerability.
transport.extractTar: The vulnerability description explicitly mentions the extractTar routine. While extractTar itself doesn't contain the direct file writing logic, it is the orchestrating function that iterates through the tar archive entries and calls extractFile for each file. The new test case TestExtractTar_SymlinkTraversalEscape in file_transfer_test.go explicitly calls extractTar to reproduce the vulnerability, confirming that extractTar is the high-level entry point that an attacker would exploit to trigger the vulnerable behavior in extractFile. Therefore, extractTar is a critical runtime indicator of the vulnerability being exploited.
Both functions are part of the transport package, as confirmed by inspecting the file_transfer.go source code. The identified functions represent the specific code paths that would be active during an exploitation attempt.
transport.extractFilefile_transfer.go
transport.extractTarfile_transfer.go