CVE-2026-25116: Path Traversal in Runtipi Homeserver

The impact of CVE-2026-25116 is significant. Successful exploitation allows an attacker to completely control the Runtipi instance's configuration. By replacing the docker-compose.yml file with a malicious version, an attacker can inject arbitrary commands and services that will be executed upon the next instance restart. This effectively grants the attacker RCE on the underlying host, enabling them to steal sensitive data, install malware, or pivot to other systems within the network. The vulnerability's unauthenticated nature means that no prior authentication is required to exploit it, significantly broadening the attack surface. This resembles the impact of configuration file manipulation vulnerabilities seen in other orchestration platforms.

1. Reserved2026-01-29
2. Published2026-01-29
3. Modified2026-02-02
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-25116 is to immediately upgrade Runtipi to version 4.7.2 or later. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the nature of the vulnerability, restricting access to the /user/config endpoint from untrusted networks can reduce the attack surface. Thoroughly review and audit the docker-compose.yml file for any unexpected modifications. After upgrading, confirm the fix by attempting to access the /user/config endpoint with a crafted path traversal request; the server should reject the request.