CVE-2026-89021

A path traversal vulnerability has been identified in the RouterOS container feature. When importing a container image, specially crafted links inside the image could cause files to be written or deleted outside of the container’s own directory, anywhere on the router’s storage. The container does not need to be started for this to happen, importing the image is enough.