CVE-2026-47277 Overview
CVE-2026-47277 is a path traversal vulnerability [CWE-22] in Runtipi, a personal homeserver orchestrator. Versions 4.9.1 through 4.9.3 serve marketplace app logos from cloned app-store repositories through an unauthenticated endpoint. The path guard validates only the lexical path before Node reads the file. A Git-based app store containing metadata/logo.jpg as a symbolic link causes Runtipi to read and return the symlink target. Attackers can read files outside the cloned repository, including /data/.env, /data/state/seed, logs, and application files. The issue is fixed in version 4.10.0.
Critical Impact
Unauthenticated attackers can disclose JWT secrets, service credentials, local configuration, and operational logs from the Runtipi container.
Affected Products
- Runtipi 4.9.1
- Runtipi 4.9.2
- Runtipi 4.9.3
Discovery Timeline
- 2026-06-17 - CVE-2026-47277 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47277
Vulnerability Analysis
Runtipi exposes a public HTTP endpoint that serves marketplace application logos from files inside cloned app-store Git repositories. The endpoint resolves a logo path under the app-store directory and passes it to Node's file read APIs. The handler applies a lexical path check to confirm the requested path stays inside the repository directory. This check does not resolve symbolic links before reading.
When a Git app store contains metadata/logo.jpg as a symbolic link, the lexical guard sees a path that appears contained within the repository. Node then follows the symlink at read time and returns the contents of the target file. The endpoint requires no authentication, so any network-reachable attacker can trigger the read after the malicious app store is cloned.
The disclosed targets depend on the container layout. Files such as /data/.env, /data/state/seed, logs, and application source can be exposed. These files contain JWT signing secrets, third-party service credentials, and operational metadata that enable follow-on attacks against the Runtipi instance and connected services.
Root Cause
The root cause is a Time-of-Check to Time-of-Use (TOCTOU) gap between lexical path validation and the underlying file read. The guard validates the requested string but does not call realpath or compare the resolved inode location against the allowed directory. Symbolic links inside the cloned repository are honored by the read syscall, bypassing the containment intent.
Attack Vector
Exploitation requires that Runtipi clone an attacker-controlled or attacker-influenced app store repository. The attacker authors a repository where metadata/logo.jpg is a symlink to an absolute path inside the Runtipi container. Once cloned, the attacker requests the logo through the public endpoint and receives the symlink target. No credentials are required to trigger the read. The CWE-22 classification reflects path traversal achieved through symbolic link resolution rather than literal ../ sequences.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-qrqj-p7hm-4m66 for vendor technical detail.
Detection Methods for CVE-2026-47277
Indicators of Compromise
- Requests to the marketplace logo endpoint returning content with non-image MIME signatures or unusual response sizes.
- Presence of symbolic links named logo.jpg, logo.png, or similar within cloned app-store directories on disk.
- Outbound or recent reads against sensitive paths such as /data/.env or /data/state/seed correlated with logo endpoint activity.
Detection Strategies
- Inventory all Runtipi instances and confirm running versions; flag any instance reporting version 4.9.1, 4.9.2, or 4.9.3.
- Inspect cloned app-store repositories for symlinks under metadata/ using find <appstore-dir> -type l.
- Audit web access logs for repeated requests to logo endpoints from unauthenticated sources, particularly following app-store updates.
Monitoring Recommendations
- Alert on file reads of .env, seed, and credential files originating from the Runtipi process.
- Monitor Git clone or pull operations that import third-party app stores and review their contents before serving.
- Track changes to JWT secrets and rotate credentials if logo endpoint anomalies are observed.
How to Mitigate CVE-2026-47277
Immediate Actions Required
- Upgrade Runtipi to version 4.10.0 or later on all instances.
- Remove any untrusted or attacker-controlled app stores configured in the instance.
- Rotate JWT secrets, service credentials, and any values stored in /data/.env if exposure is suspected.
Patch Information
The vulnerability is fixed in Runtipi 4.10.0. The patch resolves symlinks before serving file contents and rejects paths that escape the app-store directory. Release notes and source changes are documented in the Runtipi Release v4.10.0 announcement and the GitHub Security Advisory GHSA-qrqj-p7hm-4m66.
Workarounds
- Restrict configured app stores to repositories under direct administrative control until upgrade is complete.
- Place the Runtipi instance behind an authenticated reverse proxy to block unauthenticated access to logo endpoints.
- Strip symbolic links from cloned app-store directories using find <appstore-dir> -type l -delete as a temporary measure before serving.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
