CVE-2026-89021: MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical. The vendor has confirmed that the issue is not resolved in the long-term release and that the fix is carried forward only in the stable branch from 7.24.2 onward, with no backport to the long-term branch planned.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MikroTik RouterOSto a version that resolves this vulnerability.Fixed in 7.24.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs high privileges on the RouterOS device and must be able to induce a user to import a crafted container image through /container/add. Network reachability alone is not sufficient because the vector requires privileges and user interaction.
Are long-term 7.23.x deployments protected by an available fix?
No. The 7.23.x long-term branch does not contain the fix, and no fixed long-term release was available at the time of publication; container-7.23.3.npk and container-7.23.4.npk have byte-identical container binaries.
What can exploitation do before a container is started?
A crafted OCI/tar image can cause root-privileged file or directory creation outside the container root on the persistent data partition. It can also enable file deletion using overlayfs whiteouts and hardlink creation, without starting the imported container.