Runtipi

Runtipi

4 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2026-32729

Exploit
  • EPSS 0.05%
  • Veröffentlicht 13.03.2026 21:41:11
  • Zuletzt bearbeitet 17.03.2026 19:01:54

Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (via...

9.8

CVE-2026-31881

Exploit
  • EPSS 0.34%
  • Veröffentlicht 11.03.2026 18:37:11
  • Zuletzt bearbeitet 16.03.2026 20:53:43

Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin) password when a password-reset request is active, resulting in full account takeover. The endpoint POST /api/auth/reset-password...

8.8

CVE-2026-25116

Exploit
  • EPSS 0.11%
  • Veröffentlicht 29.01.2026 21:49:49
  • Zuletzt bearbeitet 26.02.2026 21:36:19

Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `UserConfigController` allows any remote user to overwrite the system's `docker-compose.yml` c...

8.8

CVE-2026-24129

Exploit
  • EPSS 0.08%
  • Veröffentlicht 22.01.2026 22:41:28
  • Zuletzt bearbeitet 26.02.2026 21:38:33

Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server by injecting shell metacha...