CVE-2026-44885 Portainer: Path traversal in backup archive extraction allows arbitrary file write
Attackers can write arbitrary files via crafted backup archives, potentially leading to code execution or privilege escalation on Portainer servers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44885?
CVE-2026-44885 is a medium-severity path traversal vulnerability in portainer, published on 28 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, Portainer's backup restore feature accepts a .tar.gz archive and extracts it to a target directory on the server. The extraction function (ExtractTarGz in api/archive/targz.go) constructed output paths using filepath.Clean(filepath.Join(outputDirPath, header.Name)). This combination does not prevent directory traversal — a tar entry named ../../etc/cron.d/evil resolves to a path outside the extraction root, so a crafted archive can write files to arbitrary locations on the server filesystem. This vulnerability is fixed in 2.33.8.
Weakness: CWE-22
Which versions are affected by CVE-2026-44885?
3 open source packages ship an affected version, including github.com/portainer/portainer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/portainer/portainer Go | All versions | None |
github.com/portainer/portainer Go | From 2.33.0 | 2.33.8 |
github.com/portainer/portainer Go | From 2.33.0 | 2.33.8 |
Products include Portainer Portainer.
How do I fix CVE-2026-44885?
Upgrade github.com/portainer/portainer to 2.33.8 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44885 being exploited?
There is no known exploitation of CVE-2026-44885 in the wild and no public exploit code.
Other vulnerabilities in portainer
Sources
Also known as GHSA-m8fg-67j7-cx4v, GO-2026-5498.