Compliance Impact

The vulnerability in Runtipi allows unauthenticated arbitrary file reads, potentially exposing sensitive files such as JWT secrets, service credentials, local configuration, and operational logs.

This unauthorized disclosure of sensitive data could lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Specifically, exposure of secrets and configuration files may compromise confidentiality requirements mandated by these regulations, increasing the risk of data breaches and regulatory penalties.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-47277 is a vulnerability in Runtipi versions 4.9.1 through 4.9.3 that allows unauthenticated arbitrary file reads via symlinks in app-store logos.

Runtipi serves marketplace app logos from files inside cloned app-store repositories through a public endpoint without authentication. The vulnerability arises because the application only checks the lexical path and does not properly validate symbolic links.

An attacker can create a malicious app-store repository containing a symlink named metadata/logo.jpg that points to sensitive files outside the cloned repository, such as /data/.env or other container files. When the endpoint processes the request, it follows the symlink and exposes the contents of the target file.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information stored within the Runtipi container.

• Exposure of JWT secrets
• Disclosure of service credentials
• Access to local configuration files such as /data/.env
• Leakage of operational logs and application files

Because the endpoint is public and unauthenticated, any attacker can exploit this to read arbitrary files, potentially compromising the confidentiality of your system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Runtipi instance is serving marketplace app logos through the unauthenticated endpoint GET /api/marketplace/apps/:urn/image and if it follows symbolic links in the app-store repositories.

To detect exploitation attempts or presence of the vulnerability, you can monitor HTTP requests to the endpoint for unusual access patterns or requests for files outside the expected repository paths.

Specific commands are not provided in the resources, but you can use network monitoring tools like curl or wget to test the endpoint, for example:

• curl -v http://<runtipi-host>/api/marketplace/apps/<app-urn>/image
• Check if the response contains unexpected file contents such as configuration files or environment variables.

Additionally, inspecting the app-store repositories for symbolic links named metadata/logo.jpg pointing outside the repository can help detect the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Runtipi to version 4.10.0 or later, where this vulnerability has been fixed.

The fix includes tightening filesystem type checks to prevent following symbolic links when serving public data and validating real paths before serving files.

If upgrading immediately is not possible, restrict access to the vulnerable endpoint by network controls or firewall rules to prevent unauthenticated access.

Review and remove any malicious or unexpected symbolic links in the app-store repositories that could be exploited.

Useful 0 Not Useful 0