CVE-2026-25116
📋 TL;DR
CVE-2026-25116 is an unauthenticated path traversal vulnerability in Runtipi homeserver orchestrator that allows remote attackers to overwrite the docker-compose.yml configuration file. This leads to remote code execution and host filesystem compromise when the instance is restarted. All Runtipi instances running versions 4.5.0 through 4.7.1 are affected.
💻 Affected Systems
- Runtipi
📦 What is this software?
Runtipi by Runtipi
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root-level access to the host, deploying malicious containers, stealing sensitive data, and establishing persistent backdoors.
Likely Case
Attackers deploy cryptocurrency miners, ransomware, or botnet clients on vulnerable systems, causing resource exhaustion and potential data loss.
If Mitigated
Attack attempts are detected and blocked by network controls, with no successful exploitation due to proper segmentation and monitoring.
🎯 Exploit Status
The vulnerability requires simple HTTP requests with path traversal payloads. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.7.2
Vendor Advisory: https://github.com/runtipi/runtipi/security/advisories/GHSA-mwg8-x997-cqw6
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Runtipi to version 4.7.2 using your deployment method. 3. Restart the Runtipi service. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to Runtipi management interface to trusted IPs only
iptables -A INPUT -p tcp --dport 3000 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP
File Permission Hardening
linuxSet strict permissions on docker-compose.yml to prevent unauthorized writes
chmod 600 /path/to/docker-compose.yml
chown root:root /path/to/docker-compose.yml
🧯 If You Can't Patch
- Isolate Runtipi instance on separate network segment with strict firewall rules
- Implement application-level WAF with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check Runtipi version via web interface or configuration files. Versions 4.5.0 through 4.7.1 are vulnerable.Check Version:
docker exec runtipi-app cat /app/package.json | grep versionVerify Fix Applied:
Confirm version is 4.7.2 or higher. Test path traversal attempts should be rejected with proper error handling.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with '../' sequences in URL parameters
- Unauthorized write attempts to docker-compose.yml
- Unexpected container restarts or new container deployments
Network Indicators:
- HTTP POST/PUT requests to UserConfigController endpoints with path traversal payloads
- Unusual outbound connections from Runtipi host after restart
SIEM Query:
source="runtipi" AND (url="*../*" OR event="*docker-compose*" OR status=500)