CVE-2026-89021: MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical, and there is no fixed long-term release at the time of publication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MikroTik RouterOS container OCI/tar image extractionto a version that resolves this vulnerability.Fixed in 7.24.2 - Compensating control
Do not import untrusted container images into RouterOS (e.g., via /container/add), since the vulnerability can be exploited during container import without starting the container.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs high privileges on the RouterOS device and must be able to induce a user to import a crafted container image through /container/add. Network reachability alone is not sufficient because the vector requires privileges and user interaction.
Are long-term 7.23.x deployments protected by an available fix?
No. The 7.23.x long-term branch does not contain the fix, and no fixed long-term release was available at the time of publication; container-7.23.3.npk and container-7.23.4.npk have byte-identical container binaries.
What can exploitation do before a container is started?
A crafted OCI/tar image can cause root-privileged file or directory creation outside the container root on the persistent data partition. It can also enable file deletion using overlayfs whiteouts and hardlink creation, without starting the imported container.