CVE-2026-44885

5.5 MEDIUM

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, ...

Published: 2026-05-28 · Last updated: 2026-06-01

Severity and scoring

CVSS: 5.5 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
CWE: CWE-22

Affected products

Vendor	Product
portainer	portainer

Description

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, Portainer's backup restore feature accepts a .tar.gz archive and extracts it to a target directory on the server. The extraction function (ExtractTarGz in api/archive/targz.go) constructed output paths using filepath.Clean(filepath.Join(outputDirPath, header.Name)). This combination does not prevent directory traversal — a tar entry named ../../etc/cron.d/evil resolves to a path outside the extraction root, so a crafted archive can write files to arbitrary locations on the server filesystem. This vulnerability is fixed in 2.33.8.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-44885
[Other]https://github.com/portainer/portainer-suite/pull/1875
[Exploit reference]https://github.com/portainer/portainer/security/advisories/GHSA-m8fg-67j7-cx4v

Related CVEs

Same vendor

CVE-2026-44884 — Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, ... (6.5 MEDIUM)
CVE-2026-44883 — Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, ... (7.5 HIGH)
CVE-2026-44882 — Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, ... (8.1 HIGH)
CVE-2026-44881 — Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, ... (9.9 CRITICAL)
CVE-2026-44850 — Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, ... (8.5 HIGH)

Same CWE

CVE-2026-52726 — Dulwich is a pure-Python implementation of the Git file formats and protocols (7.5 HIGH)
CVE-2026-49219 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.5 MEDIUM)
CVE-2026-47712 — Dulwich is a pure-Python implementation of the Git file formats and protocols (3.3 LOW)
CVE-2026-46703 — Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to ru... (9.6 CRITICAL)
CVE-2026-42305 — Dulwich is a pure-Python implementation of the Git file formats and protocols (8.8 HIGH)