# CVE-2026-89021

## Summary

- **CVE ID:** CVE-2026-89021
- **Severity:** MEDIUM
- **CVSS Score:** 6.9 (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L)
- **CWE:** CWE-59, CWE-22
- **Published:** Sep 14, 2026
- **Last Modified:** Sep 16, 2026

## Description

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical, and there is no fixed long-term release at the time of publication.

## Affected Products

- MikroTik — RouterOS (0)

## References

- [CNA](https://mikrotik.com/supportsec/september-2026-vulnerability)
- [CNA](https://www.vulncheck.com/advisories/mikrotik-routeros-path-traversal-via-container-oci-tar-image-extraction)
- [CNA](https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.24%
- **EPSS Percentile:** 15.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._