Security

Report a vulnerability

SECURITY.md

Security Policy

See our Vulnerability Disclosure Policy

qbee-io/transport TAR upload extraction can create escaping symlinks outside the destination root
GHSA-8qfp-98qg-jjwv published Aug 25, 2026 by piotrbulinski

Moderate
UDP tunnel forwards foreign device-side packets into active tunnel sessions
GHSA-xr7w-mv28-fw4c published Aug 26, 2026 by piotrbulinski

Moderate
CVE-2026-55828 incomplete fix: symlink-chain patch bypass in qbee-transport v1.26.25
GHSA-6jjj-57g2-ph6c published Jul 6, 2026 by piotrbulinski

Moderate
Symlink-chain path traversal in tar extraction (one level outside destination)
GHSA-f9m7-vc86-p6jj published Jun 16, 2026 by piotrbulinski

Moderate

Learn more about advisories related to qbee-io/transport in the GitHub Advisory Database