CVE-2026-89021 MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction
Attackers can achieve root-privileged file operations on MikroTik RouterOS by importing a crafted container image with malicious symlinks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-89021?
CVE-2026-89021 is a medium-severity path traversal vulnerability in MikroTik RouterOS, published on 14 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical. The vendor has confirmed that the issue is not resolved in the long-term release and that the fix is carried forward only in the stable branch from 7.24.2 onward, with no backport to the long-term branch planned.
Which versions are affected by CVE-2026-89021?
How do I fix CVE-2026-89021?
No fix has been published for CVE-2026-89021 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-89021 being exploited?
There is no known exploitation of CVE-2026-89021 in the wild and no public exploit code.
Sources
Also known as GHSA-46jg-fhwv-c6jp.