CVE-2026-44881

Go/github.com/portainer/portainer CVE-2026-44881: critical 9.9, EPSS 0.58%

Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

Action: Upgrade github.com/portainer/portainer to 2.33.8 or later.

go get github.com/portainer/portainer@v2.33.8

go get github.com/portainer/portainer@v2.39.2

go get github.com/portainer/portainer@v2.41.0

Affected

Fixed versions

Sources

• osv: GHSA-rpgq-m5fp-32wr
• https://github.com/portainer/portainer/security/advisories/GHSA-rpgq-m5fp-32wr
• https://nvd.nist.gov/vuln/detail/CVE-2026-44881
• https://github.com/portainer/portainer
• https://github.com/portainer/portainer/releases/tag/2.33.8
• https://github.com/portainer/portainer/releases/tag/2.39.2
• https://github.com/portainer/portainer/releases/tag/2.41.0

CVE-2026-44881 · published 2026-05-14T16:23:56Z · modified 2026-06-25T23:11:37.029317240Z · JSON

Go/github.com/portainer/portainer CVE-2026-44881: unknown, EPSS 0.58%

Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update in github.com/portainer/portainer

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5633
• https://github.com/portainer/portainer/security/advisories/GHSA-rpgq-m5fp-32wr
• https://nvd.nist.gov/vuln/detail/CVE-2026-44881
• https://github.com/portainer/portainer/releases/tag/2.33.8
• https://github.com/portainer/portainer/releases/tag/2.39.2
• https://github.com/portainer/portainer/releases/tag/2.41.0

CVE-2026-44881 · published 2026-06-25T22:34:38Z · modified 2026-06-25T23:01:25.582068588Z · JSON