GHSA-F9M7-VC86-P6JJ go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)

Impact The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library's path validation is strictly lexical and fails to account for on-disk symlinks created earlier in the extraction process. Consequently, a crafted tar archive...