CVE-2026-89021

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 7.24.2

Description A path traversal issue exists in the container package OCI/tar image extraction. This allows attackers to write files outside the container root by providing a crafted container image containing symlinks that point to arbitrary paths. By exploiting unsanitized tar member path extraction during container import via the '/container/add' endpoint, an attacker can achieve root-privileged file and directory creation, file deletion using overlayfs whiteout (a mechanism to hide files in a layered file system), and hardlink creation on the persistent data partition without starting the container.

Recommendations Update to version 7.24.2 or later. As a temporary mitigation, restrict the use of the '/container/add' endpoint to prevent the import of untrusted container images.