CVE-2026-44885

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44885", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T21:50:33.544Z", "datePublished": "2026-05-28T20:56:42.024Z", "dateUpdated": "2026-05-29T19:11:01.372Z"}, "containers": {"cna": {"title": "Portainer: Path traversal in backup archive extraction allows arbitrary file write", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/portainer/portainer/security/advisories/GHSA-m8fg-67j7-cx4v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/portainer/portainer/security/advisories/GHSA-m8fg-67j7-cx4v"}, {"name": "https://github.com/portainer/portainer-suite/pull/1875", "tags": ["x_refsource_MISC"], "url": "https://github.com/portainer/portainer-suite/pull/1875"}], "affected": [{"vendor": "portainer", "product": "portainer", "versions": [{"version": ">= 2.33.0, < 2.33.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T20:56:57.555Z"}, "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, Portainer's backup restore feature accepts a .tar.gz archive and extracts it to a target directory on the server. The extraction function (ExtractTarGz in api/archive/targz.go) constructed output paths using filepath.Clean(filepath.Join(outputDirPath, header.Name)). This combination does not prevent directory traversal \u2014 a tar entry named ../../etc/cron.d/evil resolves to a path outside the extraction root, so a crafted archive can write files to arbitrary locations on the server filesystem. This vulnerability is fixed in 2.33.8."}], "source": {"advisory": "GHSA-m8fg-67j7-cx4v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-29T19:08:51.068303Z", "id": "CVE-2026-44885", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T19:11:01.372Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44885", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T19:08:51.068303Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T19:10:57.054Z"}}], "cna": {"title": "Portainer: Path traversal in backup archive extraction allows arbitrary file write", "source": {"advisory": "GHSA-m8fg-67j7-cx4v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "portainer", "product": "portainer", "versions": [{"status": "affected", "version": ">= 2.33.0, < 2.33.8"}]}], "references": [{"url": "https://github.com/portainer/portainer/security/advisories/GHSA-m8fg-67j7-cx4v", "name": "https://github.com/portainer/portainer/security/advisories/GHSA-m8fg-67j7-cx4v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/portainer/portainer-suite/pull/1875", "name": "https://github.com/portainer/portainer-suite/pull/1875", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, Portainer's backup restore feature accepts a .tar.gz archive and extracts it to a target directory on the server. The extraction function (ExtractTarGz in api/archive/targz.go) constructed output paths using filepath.Clean(filepath.Join(outputDirPath, header.Name)). This combination does not prevent directory traversal \u2014 a tar entry named ../../etc/cron.d/evil resolves to a path outside the extraction root, so a crafted archive can write files to arbitrary locations on the server filesystem. This vulnerability is fixed in 2.33.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T20:56:57.555Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44885", "state": "PUBLISHED", "dateUpdated": "2026-05-29T19:11:01.372Z", "dateReserved": "2026-05-07T21:50:33.544Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-28T20:56:42.024Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "portainer", "vendor": "portainer", "versions": [{"status": "affected", "version": ">= 2.33.0, < 2.33.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "matchCriteriaId": "4E7FE81D-D489-4034-9DB4-D48E3B6C3CE4", "versionEndExcluding": "2.33.8", "versionStartIncluding": "2.33.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, Portainer's backup restore feature accepts a .tar.gz archive and extracts it to a target directory on the server. The extraction function (ExtractTarGz in api/archive/targz.go) constructed output paths using filepath.Clean(filepath.Join(outputDirPath, header.Name)). This combination does not prevent directory traversal \u2014 a tar entry named ../../etc/cron.d/evil resolves to a path outside the extraction root, so a crafted archive can write files to arbitrary locations on the server filesystem. This vulnerability is fixed in 2.33.8."}, {"lang": "es", "value": "Portainer Community Edition es una plataforma ligera de entrega de servicios para aplicaciones en contenedores que puede utilizarse para gestionar entornos Docker, Swarm, Kubernetes y ACI. Desde la versi\u00f3n 2.33.0 hasta antes de la 2.33.8, la funci\u00f3n de restauraci\u00f3n de copias de seguridad de Portainer acepta un archivo .tar.gz y lo extrae a un directorio de destino en el servidor. La funci\u00f3n de extracci\u00f3n (ExtractTarGz en api/archive/targz.go) constru\u00eda rutas de salida utilizando filepath.Clean(filepath.Join(outputDirPath, header.Name)). Esta combinaci\u00f3n no evita el salto de directorio \u2014 una entrada tar llamada ../../etc/cron.d/evil se resuelve en una ruta fuera de la ra\u00edz de extracci\u00f3n, por lo que un archivo malicioso puede escribir archivos en ubicaciones arbitrarias del sistema de archivos del servidor. Esta vulnerabilidad se corrige en la versi\u00f3n 2.33.8."}], "id": "CVE-2026-44885", "lastModified": "2026-07-21T10:10:00.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44885", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-29T19:08:51.068303Z", "version": "2.0.3"}}]}, "published": "2026-05-28T22:16:59.803", "references": [{"source": "security-advisories@github.com", "tags": ["Broken Link"], "url": "https://github.com/portainer/portainer-suite/pull/1875"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/portainer/portainer/security/advisories/GHSA-m8fg-67j7-cx4v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.33.0,2.33.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "portainer", "source": "cna", "vendor": "portainer"}, "product": "portainer", "vendor": "portainer"}], "created": "2026-05-28T23:30:26.256182+00:00", "updated": "2026-05-29T00:30:25.632473+00:00", "vendors": ["portainer", "portainer$PRODUCT$portainer"]}