CVE-2026-55168

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.

• CWE-59
• CWE-61

• https://github.com/runtipi/runtipi/commit/df529a211b05f3a0007b209b6c337f8c1942619c
• https://github.com/runtipi/runtipi/pull/2606
• https://github.com/runtipi/runtipi/releases/tag/v4.10.1
• https://github.com/runtipi/runtipi/security/advisories/GHSA-wcrf-g9p9-2wg7
• https://github.com/runtipi/runtipi/security/advisories/GHSA-wcrf-g9p9-2wg7

Published

Aug 21, 2026

Last Modified

Aug 25, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5516IBM WebSphere Application Server - Liberty 22.0.0.11 through…5.9
• CVE-2026-55162Lemur manages TLS certificate creation. Prior to 1.9.2, lemu…6.3
• CVE-2026-55163Lemur manages TLS certificate creation. Prior to 1.9.2, PUT …6.3
• CVE-2026-55164Lemur manages TLS certificate creation. Prior to 1.9.2, lemu…4.9
• CVE-2026-55165Lemur manages TLS certificate creation. Prior to 1.9.2, the …4.8
• CVE-2026-55166Lemur manages TLS certificate creation. Prior to 1.9.2, auth…9.9
• CVE-2026-55170OpenFGA is an authorization/permission engine built for deve…5.4
• CVE-2026-55173WWBN AVideo is an open source video platform. Versions 29.0 …8.1
• CVE-2026-55175Spinnaker is an open source, multi-cloud continuous delivery…7.5
• CVE-2026-55178GeoLens is a self-hosted geospatial data catalog with semant…7.5
• CVE-2026-55179Joplin is an open source note-taking and to-do application t…6.5
• CVE-2026-55180pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…6.5