go.qbee.io/transport CVE-2026-55828

The vulnerability (CWE-22: Path Traversal) resides in the extractTar routine of the Go library go.qbee.io/transport (pkg:go/go.qbee.io/transport). The root cause is strictly lexical path validation: the library canonicalizes and validates extraction paths using string operations only, without resolving on-disk symlinks that may have been planted by earlier entries in the same archive. This is a variant of the well-known 'Zip Slip' class of attacks, adapted for tar archives. An attacker crafts an archive that first plants a symlink within the extraction directory pointing one level up, then uses a subsequent archive entry whose path traverses through that symlink. Because the validator never follows the real filesystem state, the secondary write resolves to a location outside the intended extraction root - specifically one directory level above. The affected package is identified by CPE as pkg:go/go.qbee.io/transport, versions prior to 1.26.25.