CVE-2026-25116 Overview
CVE-2026-25116 is an unauthenticated path traversal vulnerability in Runtipi, a personal homeserver orchestrator. The flaw affects the UserConfigController component in versions 4.5.0 through 4.7.1. Insecure Uniform Resource Name (URN) parsing allows remote attackers to overwrite the primary docker-compose.yml configuration file without authentication. An attacker who replaces the stack configuration with malicious content gains Remote Code Execution (RCE) and full host filesystem compromise the next time an operator restarts the instance. Runtipi version 4.7.2 patches the vulnerability.
Critical Impact
Unauthenticated remote attackers can overwrite Runtipi's primary Docker Compose configuration, leading to full host compromise on the next service restart.
Affected Products
- Runtipi versions 4.5.0 through 4.7.1
- runtipi:runtipi self-hosted orchestrator instances
- Docker Compose stacks managed by vulnerable Runtipi releases
Discovery Timeline
- 2026-01-29 - CVE-2026-25116 published to the National Vulnerability Database (NVD)
- 2026-02-26 - Last updated in NVD database
Technical Details for CVE-2026-25116
Vulnerability Analysis
The vulnerability resides in the UserConfigController, which handles user-supplied configuration paths. The controller parses URN-style identifiers but fails to validate or normalize path segments before writing to disk. An attacker submits a crafted URN that traverses outside the intended configuration directory. The handler then writes attacker-controlled content to the system's primary docker-compose.yml file.
This file defines every container Runtipi launches at startup. By replacing it, an attacker controls image selection, mounted volumes, environment variables, and container entrypoints. The malicious stack executes with Docker daemon privileges once an operator restarts the Runtipi service. The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.
Root Cause
The root cause is insecure URN parsing inside the configuration controller. The endpoint accepts user input as a configuration identifier without enforcing a canonical base directory or rejecting traversal sequences. No authentication check guards the route, so any network-reachable attacker can invoke it.
Attack Vector
The attack vector is network-based and requires no privileges. An attacker sends an HTTP request to the vulnerable UserConfigController endpoint containing a traversal payload that resolves to the docker-compose.yml location. The request body carries a malicious Compose definition. User interaction is limited to the operator eventually restarting the instance, at which point Docker Compose instantiates the attacker's containers with host volume mounts and privileged options of their choosing.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-mwg8-x997-cqw6 for vendor technical details.
Detection Methods for CVE-2026-25116
Indicators of Compromise
- Unexpected modifications to docker-compose.yml in the Runtipi installation directory, particularly with timestamps that do not align with operator activity.
- New or unfamiliar service definitions in the Runtipi stack referencing untrusted container images or bind-mounting host paths such as /, /etc, or /root.
- HTTP requests to UserConfigController endpoints containing URN payloads with traversal sequences or absolute path fragments.
Detection Strategies
- Monitor file integrity on docker-compose.yml and related Runtipi configuration files using checksums or inotify-based watchers.
- Inspect Runtipi application logs for unauthenticated requests targeting user configuration routes and correlate with subsequent service restarts.
- Review Docker daemon events for container creations referencing images or volume mounts that are not part of the approved Runtipi app catalog.
Monitoring Recommendations
- Forward Runtipi web server access logs and Docker engine logs to a centralized logging platform for correlation and retention.
- Alert on any process writing to Runtipi configuration files outside of the documented update workflow.
- Track outbound network connections from Runtipi-managed containers to identify command-and-control activity following a successful exploit.
How to Mitigate CVE-2026-25116
Immediate Actions Required
- Upgrade Runtipi to version 4.7.2 or later, which contains the official fix.
- Restrict network access to the Runtipi management interface so it is not reachable from untrusted networks or the public internet.
- Audit the current docker-compose.yml and running containers for signs of tampering before restarting the instance.
Patch Information
Runtipi version 4.7.2 remediates the path traversal flaw in UserConfigController. Release details are available at the GitHub Release v4.7.2 page. Operators should pull the updated container image and restart the stack after verifying configuration integrity. Vendor remediation guidance is published in the GitHub Security Advisory GHSA-mwg8-x997-cqw6.
Workarounds
- Place Runtipi behind an authenticated reverse proxy or VPN to block unauthenticated access to the management API until patching is complete.
- Apply host-based firewall rules limiting inbound connections to the Runtipi service port to trusted administrator IP addresses.
- Set strict filesystem permissions on the Runtipi configuration directory so only the intended service account can modify docker-compose.yml.
# Configuration example: upgrade Runtipi to the patched release
cd /opt/runtipi
./runtipi-cli update v4.7.2
./runtipi-cli restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
