CVE-2026-55168

MediumCVSS 6.5

Published: 21/08/2026(UTC)Updated: 25/08/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

42th percentile - higher than 42% of all known CVEs

Summary

Runtipi in 4.10.0 and earlier accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during backup restore. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content, allowing writes outside the intended restore and user-config directory boundary with Runtipi process permissions.

Risk Assessment

Risk of writing files outside allowed directories, potentially leading to modification of critical system files or privilege escalation.

Recommendation

Update Runtipi to version 4.10.1 or later, which includes a fix for this vulnerability.

Other vulnerabilities in Runtipi

CVE-2026-47277Medium
Runtipi versions 4.9.1 through 4.9.3 allow arbitrary file read through an unauthenticated endpoint, leading to exposure of local files from the Runtipi container. The issue arises from improper path checking for symbolic links in app store repositories.

Original NVD description (English source)

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.