EUVD-2026-64143Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Admin authentication required (PR:H) to access restore and user-config APIs; arbitrary file write yields high integrity and availability impact with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.
AnalysisAI
Symlink-following vulnerability in Runtipi 4.10.0 and earlier enables authenticated administrators to write arbitrary content to any filesystem path accessible by the Runtipi process. An attacker with admin credentials plants a symlink inside a crafted backup archive targeting an arbitrary path, restores the archive via the backup API, and then invokes the user-config write endpoint - causing FilesystemService.writeTextFile() to follow the planted link and write attacker-controlled content outside the intended directory boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session with administrator-level privileges on the Runtipi instance, confirmed by the CVSS PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score and PR:H metric reflect a meaningful constraint: exploitation requires an authenticated administrator session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Runtipi 4.10.1, the vendor-released patch confirmed by the GitHub release at https://github.com/runtipi/runtipi/releases/tag/v4.10.1 and commit df529a211b05f3a0007b209b6c337f8c1942619c. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Runtipi versions 3.7.0 through 4.6.x suffer from arbitrary command execution when authenticated users upload backups wit
Runtipi versions 4.5.0 through 4.7.1 contain an unauthenticated path traversal vulnerability in the UserConfigController
Critical authentication bypass vulnerability in Runtipi (versions prior to 4.8.1), a personal homeserver orchestrator, w
Arbitrary file read in Runtipi 4.9.1-4.9.3 exposes sensitive container secrets via symlink following in an unauthenticat
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today