CVE-2019-3976 Path traversal in MikroTik RouterOS
An authenticated user can exploit a path traversal in the upgrade package name to create directories and enable the developer shell, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3976?
CVE-2019-3976 is a high-severity path traversal vulnerability in Mikrotik Routeros, published on 28 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled.
Which versions are affected by CVE-2019-3976?
It affects 1 product.
Products include Mikrotik Routeros.
How do I fix CVE-2019-3976?
No fix has been published for CVE-2019-3976 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-3976 being exploited?
There is no known exploitation of CVE-2019-3976 in the wild and no public exploit code.
Other vulnerabilities in Mikrotik Routeros
- CVE-2018-7445 MikroTik RouterOS Stack-Based Buffer Overflow
- CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command
- CVE-2018-14847 MikroTik Router OS Directory Traversal
- CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function
- CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow
Sources
Also known as GHSA-mqp4-vc38-m2mf.