PT-2026-5367 · Runtipi · Runtipi

Kkc73 · Published 2026-01-29 · Updated 2026-02-26 · CVE-2026-25116

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Runtipi versions 4.5.0 through 4.7.1

Description Runtipi is a personal homeserver orchestrator. An unauthenticated Path Traversal issue exists in the UserConfigController. This allows a remote user to overwrite the system's docker-compose.yml configuration file by exploiting insecure URN parsing. An attacker can replace the primary stack configuration with a malicious one, leading to full Remote Code Execution (RCE) and host filesystem compromise when the instance is restarted by the operator. The vulnerable component is the UserConfigController. The vulnerable file is docker-compose.yml.

Recommendations Versions prior to 4.7.2 are affected. Update to version 4.7.2 or later.

Exploit

Fix

RCE

Missing Authentication

Path traversal

Weakness Enumeration

CWE-306

CWE-22

Related Identifiers

CVE-2026-25116

GHSA-MWG8-X997-CQW6

Affected Products

Runtipi

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25116.json · Exploit
• https://github.com/runtipi/runtipi/security/advisories/GHSA-mwg8-x997-cqw6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25116 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25116 · Vendor Advisory
• https://github.com/runtipi/runtipi/releases/tag/v4.7.2 · Note
• https://twitter.com/VulmonFeeds/status/2017065371602235441 · Twitter Post
• https://twitter.com/CVEnew/status/2017000650278621581 · Twitter Post
• https://t.me/CVEtracker/43258 · Telegram Post
• https://t.me/cveNotify/153377 · Telegram Post