CVE-2026-55168: Runtipi: Authenticated arbitrary file write via backup restore symlink planting
Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Runtipito a version that resolves this vulnerability.Fixed in 4.10.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Runtipi. They also need to be able to supply a malicious backup archive through the backup restore flow and send a PUT request to the user-config API endpoint with attacker-controlled appEnv content.
What is the impact of a successful exploit?
The attacker can cause Runtipi to write attacker-controlled content to an arbitrary reachable filesystem path by planting a symbolic link in the restored backup. The write occurs with the permissions of the Runtipi process, which can lead to integrity and availability impacts.
Are installations running the fixed release affected?
No. The issue affects Runtipi version 4.10.0 and earlier and is fixed in version 4.10.1.
What should be done if upgrading cannot happen immediately?
Restrict backup restore access and access to the affected user-config API to trusted authenticated users only. Do not restore untrusted backup archives, since the exploit relies on symbolic links supplied in an attacker-controlled archive.