Executive brief
Runtipi, a personal home server management tool, contains a security flaw that allows unauthorized access to sensitive system files. By tricking the system into using a malicious app store repository containing specially crafted links, an attacker can remotely read internal configuration files, security keys, and logs. This could lead to the theft of login credentials or full access to the home server's data.
Technical details
Runtipi versions 4.9.1 through 4.9.3 are vulnerable to an arbitrary file read vulnerability due to improper validation of symbolic links. The application serves marketplace app logos via an unauthenticated endpoint `GET /api/marketplace/apps/:urn/image`. While a path guard exists, it only performs lexical path checks using `path.resolve` and `path.relative` without resolving the actual target of symbolic links. An attacker can provide a malicious Git app-store repository where `metadata/logo.jpg` is a symlink pointing to sensitive files outside the repository (e.g., `/data/.env`). When the application reads the file using `fs.promises.readFile`, it follows the symlink and returns the contents of the target file to the unauthenticated requester. This can result in the disclosure of JWT secrets, service credentials, and operational logs. The issue is fixed in version 4.10.0 by tightening filesystem checks.
Affected products
- runtipi Runtipi 4.9.1 - 4.9.3
Timeline
- 2026-05-20: patched: Version 4.10.0 released
- 2026-05-22: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: CVE published to NVD