Portainer Community Edition versions 2.33.0 through 2.33.7 contain a path traversal flaw in the backup restore feature. The extraction routine builds paths using filepath.Clean(filepath.Join(outputDirPath, header.Name)), which does not exclude traversal sequences. An attacker who can supply a crafted .tar.gz archive, for example with an entry named ../../etc/cron.d/evil, will cause the service to write files outside the intended extraction directory on the host filesystem. This flaw permits arbitrary file creation or modification on the server, potentially allowing the attacker to replace configuration files, install cron jobs, or otherwise manipulate system state, leading to local privilege escalation or persistence.

The affected vendor and product are Portainer Community Edition. Vulnerable versions are 2.33.0 until 2.33.7; the problem is addressed starting with version 2.33.8.

The CVSS score of 5.5 categorizes the severity as moderate. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated or accessible Portainer instance where an attacker can submit a malicious backup archive via the web interface. Successful exploitation would allow arbitrary file writes on the host, which could be used for persistence or privilege escalation.