PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44885 portainer CVE debrief

Portainer Community Edition versions 2.33.0 through 2.33.7 contain a path traversal vulnerability in the backup restore feature. The `ExtractTarGz` function in `api/archive/targz.go` constructs output paths using `filepath.Clean(filepath.Join(outputDirPath, header.Name))`, which does not prevent directory traversal. A malicious `.tar.gz` archive containing entries such as `../../etc/cron.d/evil` can write files to arbitrary locations on the server filesystem. This vulnerability requires high privileges (backup restore access) and has been assigned a CVSS 3.1 score of 5.5 (MEDIUM). The issue was fixed in Portainer CE 2.33.8.

Vendor
portainer
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations running Portainer Community Edition 2.33.0-2.33.7 with backup restore functionality enabled; security teams managing container orchestration platforms; DevOps engineers responsible for Portainer deployments

Technical summary

The vulnerability exists in the `ExtractTarGz` function within `api/archive/targz.go`. The code uses `filepath.Clean(filepath.Join(outputDirPath, header.Name))` to determine extraction paths. While `filepath.Clean` normalizes paths, it does not enforce that the result remains within the intended output directory. A tar archive entry with a name containing `../` sequences can traverse outside the extraction root. The `filepath.Join` operation concatenates the output directory with the header name, and `filepath.Clean` resolves the `..` components, potentially resulting in a path outside the intended scope. This allows an attacker with backup restore privileges to write arbitrary files to any location on the filesystem, potentially achieving code execution by overwriting cron jobs, systemd services, or other sensitive files.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Portainer Community Edition to version 2.33.8 or later
  • Restrict backup restore functionality to highly trusted administrative users only
  • Validate backup archives in isolated environments before production restore operations
  • Monitor for unexpected file modifications in system directories (e.g., /etc/cron.d/, /etc/systemd/system/)
  • Review access logs for unauthorized backup restore operations

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-m8fg-67j7-cx4v and associated pull request. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identified as root cause. Fix version 2.33.8 explicitly mentioned in advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44885 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44885

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44885 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44885

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.