CVE-2026-55168: Runtipi Path Traversal Vulnerability

CVE-2026-55168 Overview

CVE-2026-55168 is a symlink-following vulnerability in Runtipi, a personal homeserver orchestrator. Versions 4.10.0 and earlier accept symbolic links from attacker-controlled backup archives and copy them into live application paths during backup restore. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path, then issue a PUT /api/user-config/demoapp3:_user request with attacker-controlled appEnv content. The FilesystemService.writeTextFile() call follows the planted symlink, writing content outside the intended restore and user-config directory boundary with Runtipi process permissions. The issue is fixed in version 4.10.1.

Critical Impact
Authenticated attackers can write arbitrary content to any filesystem path reachable by the Runtipi process, enabling integrity and availability compromise of the host.

Affected Products

Runtipi 4.10.0 and earlier
Runtipi backup restore flow (FilesystemService.writeTextFile())
Runtipi user-config API endpoint (PUT /api/user-config/{app}:_user)

Discovery Timeline

2026-08-21 - CVE-2026-55168 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55168

Vulnerability Analysis

The vulnerability is a symbolic link following flaw [CWE-59] in Runtipi's backup restore workflow. When Runtipi processes a backup archive, it copies file entries into live application directories without validating whether those entries are regular files or symbolic links. An attacker who supplies a crafted backup archive can include a symlink named user-config/app.env that points to any path reachable by the Runtipi process on the host filesystem.

After the restore places the symlink in the user-config directory, the attacker calls PUT /api/user-config/demoapp3:_user with a chosen appEnv payload. The handler routes the write to FilesystemService.writeTextFile(), which opens the target path following symbolic links. Content is written to the symlink target rather than the intended user-config file.

Exploitation requires authenticated access with permissions to restore backups and update user configuration. The write occurs with Runtipi process privileges, so any file the process can modify is a valid target. Overwriting service configuration files, application .env files for other apps, or scripts consumed by the orchestrator can lead to service disruption or code execution paths depending on host layout.

Root Cause

The root cause is missing symlink validation in two related code paths. The backup restore does not reject or dereference symbolic link entries before extraction, and FilesystemService.writeTextFile() opens the destination file without the O_NOFOLLOW semantics needed to refuse symlinked targets. The combination allows attacker-controlled path redirection through a persisted filesystem primitive.

Attack Vector

The attack requires network access to the Runtipi API and an authenticated account with backup restore and user-config write permissions. The attacker first uploads or restores a backup archive containing a symlink at user-config/app.env pointing to a target path such as an environment file, cron file, or configuration for another running service. The attacker then sends a PUT request to /api/user-config/{appId}:_user with the desired file contents. Runtipi writes the payload through the symlink to the chosen target.

Refer to the GitHub Security Advisory GHSA-wcrf-g9p9-2wg7 and the fix commit for the code-level details of the vulnerable and patched paths.

Detection Methods for CVE-2026-55168

Indicators of Compromise

Symbolic link entries inside restored backup archives, particularly user-config/app.env pointing outside the Runtipi data directory.
Unexpected modification timestamps on files outside the Runtipi user-config tree that match Runtipi API request times.
PUT /api/user-config/{app}:_user requests from unusual sessions or shortly after a backup restore action.
Runtipi process writes to paths outside its expected data directory in filesystem audit logs.

Detection Strategies

Inspect backup archives for symlink entries before restore and reject archives containing links that resolve outside the archive root.
Correlate backup restore API calls with subsequent PUT /api/user-config/* requests from the same session.
Monitor the Runtipi service account for file writes outside its designated data directory using Linux audit rules on openat with O_WRONLY or O_CREAT.

Monitoring Recommendations

Enable and forward Runtipi application logs and reverse-proxy access logs to a centralized log store for query and alerting.
Alert on new symbolic links appearing under Runtipi's user-config directory tree.
Track privileged Runtipi API sessions and review changes to files owned or read by other services on the host.

How to Mitigate CVE-2026-55168

Immediate Actions Required

Upgrade Runtipi to version 4.10.1 or later using the v4.10.1 release notes.
Restrict backup restore and user-config write permissions to trusted administrators only.
Audit the Runtipi user-config directory tree for existing symbolic links and remove any that point outside the directory.
Review recent PUT /api/user-config/* requests and file modification times on the host for signs of exploitation.

Patch Information

Runtipi released version 4.10.1 with the fix applied in pull request #2606 and commit df529a2. The patch validates archive entries during restore and prevents FilesystemService.writeTextFile() from following symbolic links out of the user-config directory boundary.

Workarounds

Disable the backup restore feature or block the corresponding API routes at the reverse proxy until the upgrade is applied.
Run Runtipi under a dedicated low-privilege user account with filesystem access limited to its own data directory.
Use mandatory access controls such as AppArmor or SELinux to confine the Runtipi process to its expected paths.
Require code review or manual inspection of any imported backup archives before restore in shared environments.

bash

# Configuration example
# Verify installed Runtipi version and upgrade to 4.10.1 or later
rtipi --version
cd /path/to/runtipi && git fetch --tags && git checkout v4.10.1
./runtipi-cli restart

# Audit for suspicious symlinks under user-config directories
find /path/to/runtipi/user-config -type l -exec ls -l {} \;