Executive brief
Portainer, a popular management tool for containerized environments like Docker and Kubernetes, contains a flaw in its backup restoration process. An attacker with administrative access could upload a specially crafted backup file to write malicious files anywhere on the server's filesystem. This could lead to permanent control over the server or disruption of services.
Technical details
A path traversal vulnerability (CWE-22) exists in Portainer's `ExtractTarGz` function within `api/archive/targz.go`. The application uses `filepath.Join` and `filepath.Clean` on user-supplied filenames within a TAR archive without verifying that the resulting path remains within the intended destination directory. An attacker with Portainer administrator privileges can upload a malicious `.tar.gz` archive containing entries with traversal sequences (e.g., `../../etc/cron.d/evil`) to achieve arbitrary file writes. This can be used to gain host persistence or execute code, depending on the environment's permissions. The issue is fixed in versions 2.33.8 (LTS) and 2.39.0.
Affected products
- Portainer Portainer >= 2.33.0, < 2.33.8; < 2.39.0
Timeline
- 2026-02-16: patched: Fix merged to develop branch
- 2026-02-25: advisory: Version 2.39.0 released with fix
- 2026-05-07: advisory: Version 2.33.8 released with backported fix
- 2026-05-14: disclosed: GitHub Advisory published
References
- https://api.github.com/users/kolega-ai-dev
- https://github.com/kolega-ai-dev
- https://api.github.com/users/kolega-ai-dev/gists%7B/gist_id%7D
- https://api.github.com/users/kolega-ai-dev/repos
- https://avatars.githubusercontent.com/u/250560052?v=4
- https://api.github.com/users/kolega-ai-dev/events%7B/privacy%7D