PatchSiren cyber security CVE debrief
CVE-2026-44885 portainer CVE debrief
Portainer Community Edition versions 2.33.0 through 2.33.7 contain a path traversal vulnerability in the backup restore feature. The `ExtractTarGz` function in `api/archive/targz.go` constructs output paths using `filepath.Clean(filepath.Join(outputDirPath, header.Name))`, which does not prevent directory traversal. A malicious `.tar.gz` archive containing entries such as `../../etc/cron.d/evil` can write files to arbitrary locations on the server filesystem. This vulnerability requires high privileges (backup restore access) and has been assigned a CVSS 3.1 score of 5.5 (MEDIUM). The issue was fixed in Portainer CE 2.33.8.
- Vendor
- portainer
- Product
- Unknown
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-29
Who should care
Organizations running Portainer Community Edition 2.33.0-2.33.7 with backup restore functionality enabled; security teams managing container orchestration platforms; DevOps engineers responsible for Portainer deployments
Technical summary
The vulnerability exists in the `ExtractTarGz` function within `api/archive/targz.go`. The code uses `filepath.Clean(filepath.Join(outputDirPath, header.Name))` to determine extraction paths. While `filepath.Clean` normalizes paths, it does not enforce that the result remains within the intended output directory. A tar archive entry with a name containing `../` sequences can traverse outside the extraction root. The `filepath.Join` operation concatenates the output directory with the header name, and `filepath.Clean` resolves the `..` components, potentially resulting in a path outside the intended scope. This allows an attacker with backup restore privileges to write arbitrary files to any location on the filesystem, potentially achieving code execution by overwriting cron jobs, systemd services, or other sensitive files.
Defensive priority
medium
Recommended defensive actions
- Upgrade Portainer Community Edition to version 2.33.8 or later
- Restrict backup restore functionality to highly trusted administrative users only
- Validate backup archives in isolated environments before production restore operations
- Monitor for unexpected file modifications in system directories (e.g., /etc/cron.d/, /etc/systemd/system/)
- Review access logs for unauthorized backup restore operations
Evidence notes
Vulnerability confirmed via GitHub Security Advisory GHSA-m8fg-67j7-cx4v and associated pull request. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identified as root cause. Fix version 2.33.8 explicitly mentioned in advisory.
Official resources
2026-05-28