Medium [CVE-2026-89021] MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths
This medium-severity MikroTik advisory covers CVE-2026-89021 affecting MikroTik RouterOS.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future MikroTik CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A path traversal vulnerability has been identified in the RouterOS container feature. When importing a container image, specially crafted links inside the image could cause files to be written or deleted outside of the container’s own directory, anywhere on the router’s storage.
The container does not need to be started for this to happen, importing the image is enough. The issue has been assigned CVE-2026-89021.
Who is affected: Only devices that use the container feature. The container package is not installed by default, and the feature has to be explicitly enabled by the administrator.
If you do not use containers, you are not affected. RouterOS 6 does not have the container feature and is not affected.
Who can trigger it: A user with the rights to add containers on the router. The risk comes from container images obtained from untrusted sources, so this is especially relevant if you pull images from public registries.
This issue is fixed in RouterOS 7.24.2 (stable) and later releases. Note for long-term users: this fix is not included in the 7.23.x long-term branch and there is no backport planned.
Affected product named by the advisory: MikroTik RouterOS.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Mitigation checklist
- Upgrade RouterOS to a fixed release: 7.24.2.
- MikroTik always recommends keeping RouterOS devices up to date, only running container images from sources you trust, and using a strong firewall to limit exposure from untrusted networks.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.