Description

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-21T21:17:00.410Z",
  "pubdate": "2026-08-21T21:17:00.410Z",
  "executiveSummary": "An arbitrary file write vulnerability exists in Runtipi versions 4.10.0 and earlier within the backup restore flow.\nThe vulnerability allows an authenticated attacker to leverage symbolic links contained within an attacker-controlled backup archive to bypass directory boundaries.\nBy planting a symbolic link at user-config/app.env pointing to an arbitrary reachable path and sending a crafted PUT /api/user-config/demoapp3:_user request, the application writes attacker-controlled content to the target destination using Runtipi process permissions.\nThis can lead to unauthorized modification of sensitive files outside the intended restore and user-config directory boundaries.\nExploitation requires authentication and the ability to interact with the backup restore flow or API endpoints.\nThe risk is mitigated by updating to version 4.10.1.",
  "technicalDetails": "The vulnerability resides in the backup restore flow and user configuration management components of Runtipi versions 4.10.0 and earlier.\nThe root cause stems from the insecure handling of symbolic links during the extraction and processing of backup archives, specifically within the FilesystemService.writeTextFile() function.\nThe function insecurely follows symbolic links present in the filesystem without validating whether the target destination resolves to a path within the intended directory boundaries.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts or plants a malicious backup archive containing a symbolic link at user-config/app.env that points to an arbitrary file path accessible by the Runtipi process.\nSecond, the attacker initiates a backup restore or sends a PUT request to the /api/user-config/demoapp3:_user endpoint containing attacker-controlled appEnv content.\nWhen FilesystemService.writeTextFile() executes, it resolves and follows the planted symbolic link instead of rejecting the symlink or writing safely to a non-symlink target.\nConsequently, the application writes the attacker-controlled payload to the arbitrary target path specified by the symbolic link.\nBecause the write operation is performed with the privileges of the Runtipi process, this allows the modification of arbitrary files on the filesystem reachable by the service.\nAuthentication is required to execute the API request, and network exposure includes accessibility to the Runtipi API endpoints."
}