CyberRota Analysis
AI-GeneratedMikroTik RouterOS versions prior to 7.24.2 are vulnerable to a path traversal flaw in the OCI/tar image extraction process, allowing attackers to manipulate symlinks in crafted container images to write files outside the container's root directory. This can lead to unauthorized file and directory creation, deletion, and hardlinking on the persistent data partition without executing the container. Organizations using affected RouterOS versions, particularly those relying on container functionality, should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical, and there is no fixed long-term release at the time of publication.