CVE-2026-25116: Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal
Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the UserConfigController allows any remote user to overwrite the system's docker-compose.yml configuration file. By exploiting insecure URN parsing, an attacker can replace the primary stack configuration with a malicious one, resulting in full Remote Code Execution (RCE) and host filesystem compromise the next time the instance is restarted by the operator. Version 4.7.2 fixes the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25116?
CVE-2026-25116 is considered a critical vulnerability due to its potential for unauthorized access and system compromise.
How do I fix CVE-2026-25116?
To fix CVE-2026-25116, upgrade Runtipi to version 4.7.2 or later to address the Path Traversal vulnerability.
What software versions are affected by CVE-2026-25116?
CVE-2026-25116 affects Runtipi versions from 4.5.0 to 4.7.1.
Can CVE-2026-25116 be exploited remotely?
Yes, CVE-2026-25116 can be exploited remotely by unauthenticated users performing path traversal attacks.
What impact does CVE-2026-25116 have on Runtipi installations?
CVE-2026-25116 allows attackers to overwrite configuration files, potentially leading to the full compromise of the Runtipi instance.