Description

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical, and there is no fixed long-term release at the time of publication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.9",
  "pubDate": "2026-09-14T19:17:54.723Z",
  "pubdate": "2026-09-14T19:17:54.723Z",
  "executiveSummary": "MikroTik RouterOS is susceptible to a path traversal vulnerability residing within the container package's OCI/tar image extraction mechanism. This flaw permits an attacker to write, delete, or link files outside the intended container root directory. The vulnerability is triggered during the /container/add process, which fails to properly sanitize tar member paths contained within a malicious OCI image.\nBy crafting a container image featuring symlinks that point to arbitrary filesystem locations, an attacker can achieve unauthorized file system manipulations, including file creation, directory creation, deletion via overlayfs whiteout, and hardlink creation. This impact occurs on the persistent data partition without the requirement of the container entering a running state. The vulnerability affects MikroTik RouterOS versions prior to 7.24.2, including the 7.23.x long-term branch where a fix is currently unavailable. This represents a significant security risk, as it allows for arbitrary file system access with root-level privileges, potentially leading to a complete compromise of the router's underlying storage and configuration integrity.",
  "technicalDetails": "The vulnerability originates from the lack of robust input validation and path sanitization within the container package's OCI/tar image extraction logic. When an administrator or user executes the /container/add command, the RouterOS container runtime processes the archive members. The software fails to restrict file path resolution to the designated container root directory, allowing entries within the tar file to escape the sandbox environment.\nThe exploitation process involves the creation of a malformed OCI image containing malicious symlinks. By defining symlink targets that use path traversal sequences (e.g., ../), the attacker instructs the extraction engine to resolve paths outside the intended storage boundaries. Because the extraction logic is handled with elevated privileges, the system applies these operations directly to the persistent data partition.\nThe attack flow follows a structured sequence: First, the attacker provides a specifically crafted tar-based container image. Second, the target initiates the /container/add operation to import this image. Third, the container management component processes the archive, blindly following the symlink instructions provided in the tar headers. Consequently, the system performs the specified actions—such as creating files, establishing hardlinks, or triggering file deletions via overlayfs whiteout—directly against the host's filesystem. A critical aspect of this vulnerability is the persistence and immediate nature of the impact; these malicious modifications occur during the import phase, meaning the container does not need to be instantiated or executed to compromise the system integrity.\nThis vulnerability is particularly severe because it bypasses standard container isolation boundaries before the execution environment is even established. The absence of proper directory traversal prevention allows for the arbitrary manipulation of system files or user data stored within the persistent partition. Given that the container package performs these operations with root-level access, the potential for post-exploitation escalation, configuration tampering, or data exfiltration/destruction is high. Affected versions include all releases of RouterOS prior to 7.24.2. As noted, the 7.23.x long-term releases, including container-7.23.3.npk and container-7.23.4.npk, remain vulnerable, and no specific patch for the long-term branch has been released at the time of discovery."
}