CVE-2026-55168

MEDIUM 6.5

Runtipi: Authenticated arbitrary file write via backup restore symlink planting

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.

CWE	CWE-59 CWE-61
Vendor	runtipi
Product	runtipi
Published	Aug 21, 2026

Stay Ahead of the Next One

Get instant alerts for runtipi runtipi

Be the first to know when new medium vulnerabilities affecting runtipi runtipi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

runtipi / runtipi

< 4.10.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/runtipi/runtipi/security/advisories/GHSA-wcrf-g9p9-2wg7 github.com: https://github.com/runtipi/runtipi/pull/2606 github.com: https://github.com/runtipi/runtipi/commit/df529a211b05f3a0007b209b6c337f8c1942619c github.com: https://github.com/runtipi/runtipi/releases/tag/v4.10.1