CVE-2026-25116: Runtipi Path Traversal RCE Vulnerability

CVE-2026-25116 Overview

CVE-2026-25116 is a Path Traversal vulnerability affecting Runtipi, a personal homeserver orchestrator. This vulnerability exists in the UserConfigController component and allows unauthenticated remote attackers to overwrite the system's docker-compose.yml configuration file through insecure URN parsing. Successful exploitation results in full Remote Code Execution (RCE) and host filesystem compromise when the instance is restarted by the operator.

Critical Impact

Unauthenticated attackers can achieve Remote Code Execution and complete host filesystem compromise by exploiting insecure URN parsing to overwrite critical Docker configuration files.

Affected Products

• Runtipi versions 4.5.0 through 4.7.1
• Runtipi homeserver orchestrator with vulnerable UserConfigController
• Self-hosted Runtipi instances exposed to network access

Discovery Timeline

• 2026-01-29 - CVE CVE-2026-25116 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-25116

Vulnerability Analysis

This vulnerability (classified as CWE-22: Path Traversal) exists within the UserConfigController component of Runtipi. The flaw stems from improper handling of URN (Uniform Resource Name) parsing, which allows attackers to traverse outside the intended directory structure. By crafting malicious requests that exploit this parsing weakness, an attacker can write arbitrary content to the docker-compose.yml file that defines the container orchestration configuration.

The attack requires no authentication, making it particularly dangerous for internet-exposed Runtipi instances. While user interaction is required (the operator must restart the instance), the delayed execution nature of this attack makes it stealthy and potentially devastating when triggered.

Root Cause

The root cause lies in insufficient input validation and sanitization within the UserConfigController component. The URN parsing logic fails to properly neutralize special path elements such as ../ sequences, allowing attackers to escape the intended directory constraints. This enables writing to arbitrary filesystem locations, including the critical docker-compose.yml configuration file that controls the Docker container stack.

Attack Vector

The attack is network-based and requires no prior authentication. An attacker sends specially crafted HTTP requests to the vulnerable endpoint, utilizing path traversal sequences within URN parameters to target the docker-compose.yml file. The malicious payload replaces the legitimate Docker Compose configuration with an attacker-controlled version.

Once the configuration is overwritten, the attack enters a dormant phase until the Runtipi instance is restarted—either manually by the operator, through scheduled maintenance, or following a system reboot. Upon restart, Docker processes the malicious configuration, which can specify privileged containers with host filesystem mounts, execute arbitrary commands, or establish reverse shells, resulting in complete system compromise.

The vulnerability exploits insecure URN parsing in the UserConfigController to achieve path traversal. An attacker constructs malicious requests that include directory traversal sequences within URN parameters, targeting the docker-compose.yml file location. The vulnerable parser fails to sanitize these sequences, allowing writes outside the intended directory. See the GitHub Security Advisory GHSA-mwg8-x997-cqw6 for complete technical details.

Detection Methods for CVE-2026-25116

Indicators of Compromise

• Unexpected modifications to docker-compose.yml file timestamps or content
• Web server logs showing requests with path traversal sequences (../, URL-encoded variants) to UserConfigController endpoints
• Unauthorized or unexpected container definitions appearing in Docker configurations
• New privileged containers or containers with suspicious host filesystem mounts

Detection Strategies

• Implement file integrity monitoring (FIM) on the docker-compose.yml and related configuration files
• Monitor web application logs for path traversal patterns including ../, ..%2f, %2e%2e/, and similar encoded sequences
• Deploy web application firewalls (WAF) with rules to detect and block path traversal attempts
• Use SentinelOne Singularity to detect suspicious file modifications and unauthorized configuration changes

Monitoring Recommendations

• Enable audit logging for all file write operations in the Runtipi configuration directory
• Set up alerts for any modification to Docker Compose files outside of expected administrative windows
• Monitor Docker daemon logs for unexpected container configurations being loaded
• Implement network monitoring to detect suspicious HTTP requests targeting configuration endpoints

How to Mitigate CVE-2026-25116

Immediate Actions Required

• Upgrade Runtipi to version 4.7.2 or later immediately
• Audit docker-compose.yml files for any unauthorized modifications before upgrading
• Restrict network access to Runtipi instances using firewall rules or reverse proxy authentication
• Review Docker container configurations for any suspicious or unauthorized entries

Patch Information

Runtipi version 4.7.2 contains the security fix for this vulnerability. The patch addresses the insecure URN parsing in the UserConfigController to properly validate and sanitize path inputs, preventing directory traversal attacks. Users should update immediately via the official release.

Workarounds

• Place Runtipi behind a reverse proxy with authentication to prevent unauthenticated access
• Implement network-level access controls to restrict access to trusted IP addresses only
• Use file system permissions to make docker-compose.yml read-only to the Runtipi process
• Deploy a web application firewall (WAF) to filter requests containing path traversal sequences

# Configuration example - Restrict network access via iptables
# Replace 192.168.1.0/24 with your trusted network range
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP