{"id":"CVE-2026-89021","aliases":["EUVD-2026-77757","GHSA-46jg-fhwv-c6jp"],"status":"published","title":"MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction","description":"MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical. The vendor has confirmed that the issue is not resolved in the long-term release and that the fix is carried forward only in the stable branch from 7.24.2 onward, with no backport to the long-term branch planned.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00381,"percentile":0.32581,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-59"],"published":"2026-09-14T18:06:31Z","modified":"2026-10-01T15:21:49Z","products":[{"vendor":"mikrotik","product":"routeros"}],"references":[{"url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","tags":["patch","release-notes"]},{"url":"https://www.vulncheck.com/advisories/mikrotik-routeros-path-traversal-via-container-oci-tar-image-extraction","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89021"},{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability"},{"url":"https://github.com/advisories/GHSA-46jg-fhwv-c6jp"}],"sources":{"cve":[{"id":"CVE-2026-89021","title":"MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction","description":"MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical. The vendor has confirmed that the issue is not resolved in the long-term release and that the fix is carried forward only in the stable branch from 7.24.2 onward, with no backport to the long-term branch planned.","status":"published","published":"2026-09-14T18:06:31.966Z","modified":"2026-10-01T15:21:49.68Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L","level":"medium","assessor":"cna"},{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-59","CWE-22"],"updated_at":"2026-11-02T14:19:55.526923Z"}],"euvd":[{"id":"EUVD-2026-77757","description":"MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical. The vendor has confirmed that the issue is not resolved in the long-term release and that the fix is carried forward only in the stable branch from 7.24.2 onward, with no backport to the long-term branch planned.","status":"published","published":"2026-09-14T18:06:31Z","modified":"2026-10-01T15:21:49Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L","level":"medium"}],"updated_at":"2026-11-02T17:27:44.672309Z"}],"ghsa":[{"id":"GHSA-46jg-fhwv-c6jp","title":"MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package...","description":"MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical, and there is no fixed long-term release at the time of publication.","status":"published","published":"2026-09-14T21:31:42Z","modified":"2026-09-16T15:30:46Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:11:58.93371Z"}],"nvd":[{"id":"CVE-2026-89021","description":"MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical. The vendor has confirmed that the issue is not resolved in the long-term release and that the fix is carried forward only in the stable branch from 7.24.2 onward, with no backport to the long-term branch planned.","status":"published","published":"2026-09-14T19:17:54.723Z","modified":"2026-09-24T21:04:40.34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:12:46.980627Z"}]}}