CVE-2026-24129
Command Injection in Runtipi BackupManager via Unsanitized Filenames
Publication date: 2026-01-22
Last updated on: 2026-02-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| runtipi | runtipi | From 3.7.0 (inc) to 4.7.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Runtipi versions 3.7.0 and above, where an authenticated user can execute arbitrary system commands on the host server by injecting shell metacharacters into backup filenames. The BackupManager does not sanitize the filenames of uploaded backups, allowing an attacker to upload a file with shell metacharacters (e.g., $(id).tar.gz) that is stored directly on the host filesystem. During the restore process, this file is referenced and executed, enabling command execution on the host. This issue was fixed in version 4.7.0.
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker to execute arbitrary system commands on the host server, potentially leading to full compromise of the server. This can result in unauthorized access, data theft, data corruption, or disruption of services running on the server.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Runtipi to version 4.7.0 or later, as this version contains the fix for the vulnerability. Additionally, restrict authenticated user permissions to prevent arbitrary command execution and avoid uploading backup files with shell metacharacters in their filenames until the upgrade is applied.