Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/portainer/portainer | go | >= 2.33.0, < 2.33.8 | 2.33.8 |
| github.com/portainer/portainer | go | >= 2.39.0, < 2.39.2 | 2.39.2 |
| github.com/portainer/portainer | go | >= 2.40.0, < 2.41.0 | 2.41.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a two-stage process. First, an attacker provides a malicious Git repository. Portainer's git cloning functionality, specifically the git.download function (called by git.CloneRepository), was vulnerable because it used a version of go-git that would create filesystem symlinks from symlinks stored in the git repository. This allowed an attacker to create a symlink on the Portainer host's filesystem pointing to any file the Portainer process has access to. The commit a33cc4886aebaba204b458d3d456ccc176962e0c fixes this by introducing a custom filesystem wrapper (noSymlinkFS) that prevents the creation of symlinks during the clone process.
Second, after the malicious symlink is created (for example, making the docker-compose.yml file a symlink to /etc/passwd), Portainer's filesystem.GetFileContent function would be used to read the contents of the compose file. This function was vulnerable because it used os.ReadFile, which follows symlinks by default. This resulted in the function reading the contents of the arbitrary file pointed to by the symlink and returning it to the user, leading to arbitrary file read. The vulnerability description confirms that a fix was applied to GetFileContent to resolve symlinks and validate the path, providing a defense-in-depth approach, although the primary fix was preventing the symlink creation in the first place.
git.downloadapi/git/git.go
git.CloneRepositoryapi/git/service.go
filesystem.GetFileContentapi/filesystem/filesystem.go