CVE-2026-89021 is a path traversal vulnerability in MikroTik RouterOS prior to version 7.24.2 affecting the container package's OCI/tar image extraction. Attackers can supply a specially crafted container image containing symlinks that point outside the container root, enabling unauthorized file system modifications such as root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition. This occurs during the container import process via /container/add without needing to start the container. The vulnerability is present in all versions before 7.24.2, including the 7.23.x long-term branch, which does not yet have a fixed release.

Successful exploitation allows attackers with appropriate privileges to perform unauthorized file system operations with root privileges on the persistent data partition of the RouterOS device. This includes creating or deleting files and directories outside the container root, potentially compromising system integrity and persistence. The vulnerability requires some privileges (PR:H) and partial user interaction (UI:P), and does not affect confidentiality or availability directly but impacts system integrity and security isolation.

A fixed version is available starting from MikroTik RouterOS 7.24.2. Users should upgrade to version 7.24.2 or later to remediate this vulnerability. The 7.23.x long-term branch does not contain a fix at the time of this report, so users on that branch should consider upgrading to the fixed 7.24.2 release or later. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version information stating the fix is in 7.24.2.