CVE-2026-25116
- Source
- https://cve.org/CVERecord?id=CVE-2026-25116
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25116.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-25116
- Aliases
-
- GHSA-mwg8-x997-cqw6
- Published
- 2026-01-29T21:49:49.450Z
- Modified
- 2026-03-01T02:57:04.796917Z
- Severity
-
- 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L CVSS Calculator
- Summary
- Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal
- Details
-
Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the
UserConfigControllerallows any remote user to overwrite the system'sdocker-compose.ymlconfiguration file. By exploiting insecure URN parsing, an attacker can replace the primary stack configuration with a malicious one, resulting in full Remote Code Execution (RCE) and host filesystem compromise the next time the instance is restarted by the operator. Version 4.7.2 fixes the vulnerability. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-22", "CWE-306" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25116.json" }- References
Affected packages
Git / github.com/runtipi/runtipi
Affected versions
Other
e2e
nightly
v4.*
v4.5.0
v4.5.1
v4.5.2
v4.5.2-alpha.1
v4.5.3
v4.5.4
v4.5.5
v4.6.0
v4.6.0-beta.1
v4.6.0-beta.2
v4.6.1
v4.6.2
v4.6.3
v4.6.3-beta.1
v4.6.3-beta.2
v4.6.4
v4.6.5
v4.7.0
v4.7.0-alpha.1
v4.7.0-alpha.2
v4.7.0-beta.1
v4.7.0-beta.2
v4.7.0-beta.3
v4.7.1
v4.7.1-beta.1
v4.7.2-beta.1