qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-55828 · Microsoft / collected KEV context

EUVD-2026-78783

GHSA-f9m7-vc86-p6jj

GO-2026-5352

cve-program · CVE-2026-55828

• https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj
• https://github.com/qbee-io/transport/pull/19
• https://github.com/qbee-io/transport/commit/43947671ba9be8fb08b105f3539a112ee7a57ddc

euvd · EUVD-2026-78783

• https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj
• https://github.com/qbee-io/transport/pull/19
• https://github.com/qbee-io/transport/commit/43947671ba9be8fb08b105f3539a112ee7a57ddc

nvd · CVE-2026-55828

• https://github.com/qbee-io/transport/commit/43947671ba9be8fb08b105f3539a112ee7a57ddc
• https://github.com/qbee-io/transport/pull/19
• https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj

osv · GHSA-f9m7-vc86-p6jj

• https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj
• https://github.com/qbee-io/transport

osv · GO-2026-5352

• https://github.com/qbee-io/transport/security/advisories/GHSA-f9m7-vc86-p6jj

No related operational record is retained in the current change model.