tocsin

Go/github.com/portainer/portainer CVE-2026-44881: critical 9.9, EPSS 0.58%

Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

Action: Upgrade github.com/portainer/portainer to 2.33.8 or later.

go get github.com/portainer/portainer@v2.33.8
go get github.com/portainer/portainer@v2.39.2
go get github.com/portainer/portainer@v2.41.0

Affected

introducedfixedlast affected
2.33.02.33.8-
2.39.02.39.2-
2.40.02.41.0-

Fixed versions

2.33.82.39.22.41.0

Sources

CVE-2026-44881 · published · modified · JSON