CVE-2026-55168

Received Received - Intake

Symbolic Link Traversal in Runtipi Backup Restore

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-55168

EUVD

EUVD-2026-64143

Affected Vendors & Products

Vendor	Product	Version / Range
runtipi	runtipi	to 4.10.0 (inc)
runtipi	runtipi	to 4.10.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-61	The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

Runtipi versions 4.10.0 and earlier allow authenticated attackers to exploit a symlink attack during backup restoration. By crafting a malicious backup archive containing a symbolic link pointing to an arbitrary path, an attacker can trick the system into writing files outside the intended directories. This occurs because the backup restore process follows symlinks without proper validation.

Detection Guidance

This vulnerability involves symbolic link attacks during backup restoration in Runtipi versions 4.10.0 and earlier. To detect it, inspect backup archives for symlinks pointing outside intended directories, particularly user-config/app.env. Check Runtipi logs for unusual file writes or PUT requests to /api/user-config/demoapp3:_user with unexpected appEnv content.

Impact Analysis

An attacker could overwrite critical system files or configuration files with malicious content, potentially leading to denial of service, privilege escalation, or unauthorized data access. Since the exploit runs with Runtipi process permissions, it may affect the entire application environment.

Compliance Impact

This vulnerability could lead to unauthorized file modifications or data exposure, violating integrity and confidentiality requirements in GDPR and HIPAA. Compliance may be compromised if sensitive data is accessed or altered without authorization due to the lack of proper file boundary enforcement.

Mitigation Strategies

Upgrade Runtipi to version 4.10.1 or later immediately. If upgrading is not possible, restrict write permissions to the user-config directory and validate backup archives for symlinks before restoration. Monitor filesystem activity for unauthorized writes to critical paths.

Hi! I’m here to help you understand CVE-2026-55168. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70