PT-2026-4303 · Runtipi · Runtipi

Kkc73 · Published 2026-01-22 · Updated 2026-02-26 · CVE-2026-24129

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Runtipi versions 3.7.0 through 4.6.9

Description Runtipi is a Docker-based, personal homeserver orchestrator. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server. This occurs because the BackupManager does not sanitize filenames of uploaded backups, leading to the persistence of user-uploaded files directly to the host filesystem using the original filename provided in the request. An attacker can stage a file containing shell metacharacters at a predictable path, which is then referenced during the restore process, allowing for command execution. The BackupManager is the component affected. The vulnerable operation involves the storage and restoration of backup files.

Recommendations Update to version 4.7.0 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-24129

GHSA-VRGF-RCJ5-6GV9

Affected Products

Runtipi

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24129.json · Exploit
• https://github.com/runtipi/runtipi/security/advisories/GHSA-vrgf-rcj5-6gv9 · Vendor Advisory
• https://github.com/runtipi/runtipi/commit/c3aa948885554a370d374692158a3bfe1cfdc85a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24129 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24129 · Vendor Advisory
• https://github.com/runtipi/runtipi/releases/tag/v4.7.0 · Note
• https://t.me/cveNotify/149629 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014540468445458445 · Twitter Post
• https://twitter.com/TheHackerWire/status/2014479897062998100 · Twitter Post
• https://twitter.com/CVEnew/status/2014577000586084722 · Twitter Post
• https://t.me/cveNotify/153376 · Telegram Post
• https://twitter.com/pulsepatchio/status/2015069113425826066 · Twitter Post