CVSS: 9.0EPSS: %CPEs: 1EXPL: 0CVE-2026-25116 – Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal
https://notcve.org/view.php?id=CVE-2026-25116
29 Jan 2026 — Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `UserConfigController` allows any remote user to overwrite the system's `docker-compose.yml` configuration file. By exploiting insecure URN parsing, an attacker can replace the primary stack configuration with a malicious one, resulting in full Remote Code Execution (RCE) and host filesystem compromise the next time the instance is restarted by the opera... • https://github.com/runtipi/runtipi/releases/tag/v4.7.2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-306: Missing Authentication for Critical Function •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2026-24129 – Runtipi is Vulnerable to Authenticated Arbitrary Remote Code Execution
https://notcve.org/view.php?id=CVE-2026-24129
22 Jan 2026 — Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server by injecting shell metacharacters into backup filenames. The BackupManager fails to sanitize the filenames of uploaded backups. The system persists user-uploaded files directly to the host filesystem using the raw originalname provided in the request. This allows an attacker to stage a f... • https://github.com/runtipi/runtipi/commit/c3aa948885554a370d374692158a3bfe1cfdc85a • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •