Vulnerability · Published Jan 29, 2026 · Assigned by GitHub_M

CVE-2026-25116Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal

High 7.6

In plain English

A high-severity path traversal in runtipi from runtipi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.6%top 49.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `UserConfigController` allows any remote user to overwrite the system's `docker-compose.yml` configuration file. By exploiting insecure URN parsing, an attacker can replace the primary stack configuration with a malicious one, resulting in full Remote Code Execution (RCE) and host filesystem compromise the next time the instance is restarted by the operator. Version 4.7.2 fixes the vulnerability.

Affected products (as reported)

Vendor	Product	Versions
runtipi	runtipi	>= 4.5.0, < 4.7.2

Weakness: CWE-22, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

References

https://github.com/runtipi/runtipi/security/advisories/GHSA-mwg8-x997-cqw6 x_refsource_CONFIRM
https://github.com/runtipi/runtipi/releases/tag/v4.7.2 x_refsource_MISC