# CVE-2026-44885: Portainer Community Edition directory traversal in backup restore

Source: https://junglewise.ai/threats/cve-2026-44885-portainer-community-edition-directory-traversal-in-backup-restore  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44885 · Severity: medium · CVSS 5.5 · Published 2026-05-28

Portainer, a popular management tool for containerized environments like Docker and Kubernetes, contains a flaw in its backup restoration process. An attacker with administrative access could upload a specially crafted backup file to write malicious files anywhere on the server's filesystem. This could lead to permanent control over the server or disruption of services.

Technologies: [github.com/portainer/portainer (Go)](https://junglewise.ai/threats/technologies/github-com-portainer-portainer), [Portainer](https://junglewise.ai/threats/technologies/portainer), [Portainer Community Edition](https://junglewise.ai/threats/technologies/portainer-community-edition). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Portainer](https://junglewise.ai/threats/vendors/portainer).

## Quick answers

**Is CVE-2026-44885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44885 being exploited in the wild.

**How severe is CVE-2026-44885?** Medium severity, with a CVSS score of 5.5, published 28 May 2026.

**Which products and versions are affected?** github.com/portainer/portainer (Go) >= 2.33.0, < 2.33.8, SEMVER:introduced=0, SEMVER:introduced=2.33.0,fixed=2.33.8; Portainer < 2.33.8, 2.34.x - 2.38.x, < 2.39.0, >= 2.33.0, < 2.33.8; < 2.39.0; Portainer Community Edition 2.33.0 to < 2.33.8; 2.34.x to 2.38.x (EOL).

**Is there a fix for CVE-2026-44885?** Yes. github.com/portainer/portainer (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44885 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44885?** Check whether you run github.com/portainer/portainer (Go), Portainer or Portainer Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/portainer/portainer (Go): upgrade to 2.33.8 or later

  ```sh
  go get github.com/portainer/portainer@v2.33.8
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in Portainer's `ExtractTarGz` function within `api/archive/targz.go`. The application uses `filepath.Join` and `filepath.Clean` on user-supplied filenames within a TAR archive without verifying that the resulting path remains within the intended destination directory. An attacker with Portainer administrator privileges can upload a malicious `.tar.gz` archive containing entries with traversal sequences (e.g., `../../etc/cron.d/evil`) to achieve arbitrary file writes. This can be used to gain host persistence or execute code, depending on the environment's permissions. The issue is fixed in versions 2.33.8 (LTS) and 2.39.0.

## Affected products

- Portainer Portainer >= 2.33.0, < 2.33.8; < 2.39.0

## Identifiers

- CVE-2026-44885
- GHSA-m8fg-67j7-cx4v
- GO-2026-5498

## Timeline

- 2026-02-16: patched: Fix merged to develop branch
- 2026-02-25: advisory: Version 2.39.0 released with fix
- 2026-05-07: advisory: Version 2.33.8 released with backported fix
- 2026-05-14: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/kolega-ai-dev](https://api.github.com/users/kolega-ai-dev)
- [https://github.com/kolega-ai-dev](https://github.com/kolega-ai-dev)
- [https://api.github.com/users/kolega-ai-dev/gists%7B/gist_id%7D](https://api.github.com/users/kolega-ai-dev/gists%7B/gist_id%7D)
- [https://api.github.com/users/kolega-ai-dev/repos](https://api.github.com/users/kolega-ai-dev/repos)
- [https://avatars.githubusercontent.com/u/250560052?v=4](https://avatars.githubusercontent.com/u/250560052?v=4)
- [https://api.github.com/users/kolega-ai-dev/events%7B/privacy%7D](https://api.github.com/users/kolega-ai-dev/events%7B/privacy%7D)

## Related threats

- [Portainer Community Edition improper authentication in setup endpoints](https://junglewise.ai/threats/cve-2026-55761-portainer-community-edition-improper-authentication-in-setup)
- [Portainer Community Edition missing authorization in custom template endpoint](https://junglewise.ai/threats/cve-2026-44884-portainer-community-edition-missing-authorization-in-custom)
- [Portainer Community Edition sensitive token leakage via URL query parameter](https://junglewise.ai/threats/cve-2026-44883-portainer-community-edition-sensitive-token-leakage-via-url-query)
- [Portainer authorization bypass in Kubernetes middleware](https://junglewise.ai/threats/cve-2026-44882-portainer-authorization-bypass-in-kubernetes-middleware)
- [Portainer Community Edition arbitrary file read via Git symlink injection](https://junglewise.ai/threats/cve-2026-44881-portainer-community-edition-arbitrary-file-read-via-git-symlink)