CVE-2026-44885: fallo de gravedad media en portainer
Portainer: Path traversal in backup archive extraction allows arbitrary file write
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.5epss 0.6%
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, Portainer's backup restore feature accepts a .tar.gz archive and extracts it to a target directory on the server. The extraction function (ExtractTarGz in api/archive/targz.go) constructed output paths using filepath.Clean(filepath.Join(outputDirPath, header.Name)). This combination does not prevent directory traversal — a tar entry named ../../etc/cron.d/evil resolves to a path outside the extraction root, so a crafted archive can write files to arbitrary locations on the server filesystem. This vulnerability is fixed in 2.33.8.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
Productos afectados
portainer · portainerCVEs relacionadas — portainer
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-44881HIGHPortainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-UpdateEPSS 0.5%CVE-2026-55761HIGHPortainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer InstancesEPSS 0.5%CVE-2026-44849CRITICALPortainer: Endpoint security bypass via Swarm service create/updateEPSS 0.4%CVE-2026-44848CRITICALPortainer: Missing authorization on Docker plugin endpoints allows host RCEEPSS 0.4%CVE-2025-49593MEDIUMPortainer HTTP Headers May Leak to Malicious Container RegistriesEPSS 0.4%CVE-2026-44882HIGHPortainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorizationEPSS 0.3%