Description (CNA)
Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `UserConfigController` allows any remote user to overwrite the system's `docker-compose.yml` configuration file. By exploiting insecure URN parsing, an attacker can replace the primary stack configuration with a malicious one, resulting in full Remote Code Execution (RCE) and host filesystem compromise the next time the instance is restarted by the operator. Version 4.7.2 fixes the vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| runtipi / runtipi | affected >= 4.5.0, < 4.7.2 |
CWE
CWE-22, CWE-306
References
- https://github.com/runtipi/runtipi/security/advisories/GHSA-mwg8-x997-cqw6
- https://github.com/runtipi/runtipi/releases/tag/v4.7.2
ADP enrichment
No English description supplied.
No references supplied.