CVE-2026-47277

Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo symlinks. The path guard checks only the lexical path before Node reads the file, so a Git app store that contains metadata/logo.jpg as a symbolic link can cause Runtipi to read and return the symlink target. Because the endpoint is public and the symlink target may point outside the cloned repository, this can expose local files from the Runtipi container such as /data/.env, /data/state/seed, logs, or application files. This can disclose JWT secrets, service credentials, local configuration, and operational logs depending on the instance. The issue has been fixed in version 4.10.0.

• CWE-22
• CWE-59

• https://github.com/runtipi/runtipi/releases/tag/v4.10.0
• https://github.com/runtipi/runtipi/security/advisories/GHSA-qrqj-p7hm-4m66
• https://github.com/runtipi/runtipi/security/advisories/GHSA-qrqj-p7hm-4m66

Published

Jun 17, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47271pam_usb provides hardware authentication for Linux using ord…5.1
• CVE-2026-47272pam_usb provides hardware authentication for Linux using ord…7.1
• CVE-2026-47273pam_usb provides hardware authentication for Linux using ord…6.5
• CVE-2026-47274pam_usb provides hardware authentication for Linux using ord…6.3
• CVE-2026-47275In nanomq versions 0.24.11 and earlier, a NULL pointer deref…2.6
• CVE-2026-47276In nanomq versions 0.24.11 and earlier, a NULL pointer deref…6.5
• CVE-2026-47279NocoDB is software for building databases as spreadsheets. P…6.9
• CVE-2026-4728Spoofing issue in the Privacy: Anti-Tracking component. This…6.5
• CVE-2026-47280Improper authentication in Azure Resource Manager (ARM) allo…9.8
• CVE-2026-47281Missing authorization in Visual Studio Code allows an unauth…9.6
• CVE-2026-47282Insufficiently protected credentials in GitHub Copilot and V…6.5
• CVE-2026-47284Exposure of sensitive information to an unauthorized actor i…6.5