Runtipi anfällig für nicht authentifizierte docker-compose.yml Überschreibung über Pfadübersprung

The impact of CVE-2026-25116 is severe. Successful exploitation allows an attacker to completely control the Runtipi instance's configuration. By replacing the docker-compose.yml file with a malicious version, an attacker can dictate which containers are launched, what services are exposed, and ultimately, what code is executed on the host system. This can lead to data exfiltration, persistent backdoor access, and complete compromise of the underlying infrastructure. The ability to overwrite the core configuration without authentication significantly lowers the barrier to entry for attackers, making this a high-priority vulnerability to address. The potential for RCE is particularly concerning, as it allows attackers to execute arbitrary commands with the privileges of the Runtipi process, potentially escalating privileges and gaining further control over the system.

Users running Runtipi in exposed environments, particularly those with limited network segmentation, are at the highest risk. Shared hosting environments where multiple users share the same Runtipi instance are also particularly vulnerable, as an attacker could potentially compromise the entire host.

• docker: Inspect running containers for unexpected processes or configurations.

docker ps --format '{{.Names}} {{.Image}}' | grep -i 'malicious'
docker inspect <container_name> | grep -i 'docker-compose.yml'

• linux / server: Monitor system logs for unusual activity related to the Runtipi process.

journalctl -u runtipi -f | grep -i 'error'

• generic web: Monitor access logs for requests targeting /user/config with suspicious path traversal patterns (e.g., ../). • generic web: Check response headers for unexpected content or redirection.

1. 2026-01-29Disclosure

   disclosure

1. Reserviert2026-01-29
2. Veröffentlicht2026-01-29
3. Geändert2026-02-02
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-25116 is to immediately upgrade Runtipi to version 4.7.2 or later. This version includes a fix that prevents the insecure URN parsing that enables the Path Traversal vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the nature of the vulnerability, carefully scrutinizing any external configuration files loaded by Runtipi could provide a limited layer of defense. Regularly review the docker-compose.yml file for any unexpected changes. After upgrading, confirm the fix by attempting a path traversal attack against the UserConfigController endpoint and verifying that the system rejects the attempt.