Executive brief
MikroTik RouterOS is an operating system for network routers that includes a container runtime feature for running isolated applications. A path traversal vulnerability in the container image extraction process allows attackers to write files to arbitrary locations on the router with root privileges by uploading a specially crafted container image, potentially compromising the entire device and its network.
Technical details
The vulnerability is a path traversal (CWE-22) and symlink-following (CWE-59) flaw in the OCI/tar image extraction logic within RouterOS's container package. During container import via the /container/add endpoint, unsanitized tar member paths are extracted, allowing an attacker to supply a crafted image containing symlinks pointing to arbitrary filesystem paths. An authenticated user with container management privileges can exploit this to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition—all without starting the container. The attack requires network access and high privileges (container admin role), with possible user interaction for image import. A fix is available in RouterOS 7.24.2 and later stable releases, but the vulnerability remains unpatched in the 7.23.x long-term branch with no backport planned.
Affected products
- MikroTik RouterOS before 7.24.2; 7.23.x long-term branch
Timeline
- 2026-09-14: disclosed
- 2026-09-03: patched: Fix released in RouterOS 7.24.2 stable; 7.23.x long-term branch not patched