Runtipi
Monthly
Critical authentication bypass vulnerability in Runtipi (versions prior to 4.8.1), a personal homeserver orchestrator, where attackers with stolen credentials can brute-force TOTP codes due to missing rate limiting. The vulnerability allows complete bypass of two-factor authentication in approximately 33 minutes, effectively compromising account security. While not currently in CISA KEV or showing high EPSS scores, the vulnerability has a CVSS 8.1 rating and a patch is available in version 4.8.1.
Runtipi versions 4.5.0 through 4.7.1 contain an unauthenticated path traversal vulnerability in the UserConfigController that allows remote attackers to overwrite the docker-compose.yml configuration file through insecure URN parsing. An attacker can inject a malicious stack configuration that executes arbitrary code when the instance restarts, achieving full remote code execution and host compromise. Public exploit code exists and no patch is currently available.
Runtipi versions 3.7.0 through 4.6.x suffer from arbitrary command execution when authenticated users upload backups with malicious filenames containing shell metacharacters, which the BackupManager fails to sanitize before executing restore operations. An attacker with valid credentials can craft a backup filename like $(id).tar.gz to achieve remote code execution on the host server with the privileges of the Runtipi process. Public exploit code exists for this vulnerability, and patches are available in version 4.7.0 and later.
Critical authentication bypass vulnerability in Runtipi (versions prior to 4.8.1), a personal homeserver orchestrator, where attackers with stolen credentials can brute-force TOTP codes due to missing rate limiting. The vulnerability allows complete bypass of two-factor authentication in approximately 33 minutes, effectively compromising account security. While not currently in CISA KEV or showing high EPSS scores, the vulnerability has a CVSS 8.1 rating and a patch is available in version 4.8.1.
Runtipi versions 4.5.0 through 4.7.1 contain an unauthenticated path traversal vulnerability in the UserConfigController that allows remote attackers to overwrite the docker-compose.yml configuration file through insecure URN parsing. An attacker can inject a malicious stack configuration that executes arbitrary code when the instance restarts, achieving full remote code execution and host compromise. Public exploit code exists and no patch is currently available.
Runtipi versions 3.7.0 through 4.6.x suffer from arbitrary command execution when authenticated users upload backups with malicious filenames containing shell metacharacters, which the BackupManager fails to sanitize before executing restore operations. An attacker with valid credentials can craft a backup filename like $(id).tar.gz to achieve remote code execution on the host server with the privileges of the Runtipi process. Public exploit code exists for this vulnerability, and patches are available in version 4.7.0 and later.