Executive brief
Runtipi is a personal homeserver orchestrator that manages multiple applications. An authenticated attacker can exploit a symlink handling vulnerability in the backup restore feature to write arbitrary files to the system with Runtipi's permissions, potentially compromising the entire server and all hosted applications.
Technical details
The vulnerability is a path traversal / arbitrary file write flaw in the backup restore functionality. When processing an attacker-controlled backup archive, Runtipi does not properly validate symbolic links before extracting them. An authenticated attacker can craft a backup containing a symlink at user-config/app.env pointing to an arbitrary writable path on the filesystem. During restore, the application's FilesystemService.writeTextFile() method follows this symlink and writes attacker-supplied content (via PUT /api/user-config/demoapp3:_user with malicious appEnv parameter) outside the intended restore boundary, achieving arbitrary file write with Runtipi process privileges. The vulnerability requires authentication but no user interaction. Fixed in version 4.10.1 by validating extracted restore contents and restricting file types before replacing live files.
Affected products
- Runtipi Runtipi 4.10.0 and earlier
Timeline
- 2026-08-21: disclosed
- 2026-06-01: patched: Fix released in version 4.10.1