CVE-2026-24129 Runtipi is Vulnerable to Authenticated Arbitrary Remote Code Execution
Authenticated attackers can execute arbitrary system commands on the host by injecting shell metacharacters into backup filenames during restore operations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-24129?
CVE-2026-24129 is a high-severity command injection vulnerability in runtipi, published on 22 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server by injecting shell metacharacters into backup filenames. The BackupManager fails to sanitize the filenames of uploaded backups. The system persists user-uploaded files directly to the host filesystem using the raw originalname provided in the request. This allows an attacker to stage a file containing shell metacharacters (e.g., $(id).tar.gz) at a predictable path, which is later referenced during the restore process. The successful storage of the file is what allows the subsequent restore command to reference and execute it. This issue has been fixed in version 4.7.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-24129?
It affects 1 product.
Products include Runtipi Runtipi.
How do I fix CVE-2026-24129?
No fix has been published for CVE-2026-24129 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-24129 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24129 exists.
Other vulnerabilities in runtipi
- CVE-2026-32729 Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`
- CVE-2026-31881 Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window
- CVE-2026-25116 Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal
Sources
Also known as GHSA-vrgf-rcj5-6gv9.