What is the CVSS score of CVE-2026-25116?

CVE-2026-25116 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Docker are affected by CVE-2026-25116?

An unauthenticated remote vulnerability in Runtipi versions 4.5.0 through 4.7.1 allows attackers to modify critical system configuration files without credentials, potentially compromising the entire…

Is there a public PoC exploit available for CVE-2026-25116?

Yes, a public proof-of-concept exploit is available for CVE-2026-25116. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25116?

Within 24 hours: Identify all systems running Runtipi versions 4.5.0-4.7.1 and isolate them from untrusted networks if possible; implement WAF rules to block requests to the vulnerable UserConfigController endpoint. Within 7 days: Upgrade to Runtipi version 4.7.2 or later if available, or disable the UserConfigController feature entirely. Within 30 days: Conduct a full security audit of affected systems to detect any unauthorized docker-compose.yml modifications and verify system integrity.

Docker CVE-2026-25116

HIGH

Path Traversal (CWE-22)

2026-01-29 security-advisories@github.com

RCE Docker Path Traversal Runtipi

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Feb 26, 2026 - 21:36 vuln.today

Public exploit code

CVE Published

Jan 29, 2026 - 22:15 nvd

HIGH 7.6

DescriptionGitHub Advisory

Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the UserConfigController allows any remote user to overwrite the system's docker-compose.yml configuration file. By exploiting insecure URN parsing, an attacker can replace the primary stack configuration with a malicious one, resulting in full Remote Code Execution (RCE) and host filesystem compromise the next time the instance is restarted by the operator. Version 4.7.2 fixes the vulnerability.

AnalysisAI

Runtipi versions 4.5.0 through 4.7.1 contain an unauthenticated path traversal vulnerability in the UserConfigController that allows remote attackers to overwrite the docker-compose.yml configuration file through insecure URN parsing. An attacker can inject a malicious stack configuration that executes arbitrary code when the instance restarts, achieving full remote code execution and host compromise. Public exploit code exists and no patch is currently available.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Runtipi. Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the UserConfigController allows any remote user to overwrite the system's docker-compose.yml configuration file. By exploiting insecure URN parsing, an attacker can replace the primary stack configuration with a malicious one, resulting in full Remote Code Execution (RCE) and host filesystem compromise the next time the instance is restarted

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.