CVE-2026-55168

Executive Summary

CVE-2026-55168 is a symbolic link (symlink) processing vulnerability in Runtipi, a personal homeserver orchestrator, affecting versions 4.10.0 and earlier. During the backup restore workflow, Runtipi fails to validate symbolic links embedded within attacker-controlled backup archives, allowing an authenticated attacker to redirect file-write operations to arbitrary paths on the host filesystem. Successful exploitation enables arbitrary file write with the privileges of the Runtipi process, resulting in a high confidentiality-neutral, high integrity/high availability impact profile (CVSS 6.5). A fix has been released in version 4.10.1, though patch confirmation from independent sources is still pending.

Technical Analysis

Runtipi is a self-hosted application orchestrator designed to simplify deployment and management of services on personal home servers. As part of its normal operation, it supports backup creation and restoration, a feature critical for disaster recovery in self-managed environments.

The vulnerability resides in the interaction between three components of the backup restore flow:

1. Archive Extraction Without Symlink Validation: When an authenticated attacker uploads a backup archive for restoration, Runtipi extracts the archive contents. The NVD description indicates the application does not adequately validate or reject symbolic links contained within the archive. A malicious archive can therefore contain a symbolic link entry that points to an arbitrary, attacker-selected filesystem path.

2. Symlink Planted into Application Paths: After extraction, the attacker-controlled archive content — including the planted symlink — is copied into live application directories. Specifically, the NVD description indicates that the path user-config/app.env can be replaced by a symlink pointing to any path reachable by the Runtipi process.

3. Write Primitive via User Configuration Update: The attacker then sends an HTTP PUT request to the API endpoint /api/user-config/demoapp3:_user with attacker-specified content in the appEnv parameter. The application invokes FilesystemService.writeTextFile(), which resolves the file path and follows the planted symlink. Instead of writing within the intended user-config directory boundary, the content is written to the arbitrary path specified by the symlink target.

The root cause is a classic CWE-59: Improper Link Resolution Before File Access (also known as "link following"). The application fails to perform a TOCTOU-safe check of whether path components are symlinks before performing write operations. The combination of accepting untrusted archives without sanitization and then performing high-privilege file writes on extracted content creates the exploitation primitive.

Notably, the vulnerability requires authenticated access (CVSS PR:H) but no user interaction (UI:N). The attack surface is network-exposed (AV:N) and the attack has low complexity (AC:L). The confidentiality impact is rated NONE because the vulnerability only affects write operations, not read operations. Both integrity and availability impacts are rated HIGH, reflecting the ability to overwrite arbitrary files (including system configuration, application binaries, or orchestration state) with process-level permissions.

Exploitation Scenarios

Reconnaissance and Target Identification: An attacker first identifies a Runtipi instance exposed on the network. Runtipi, being a homeserver orchestrator, is typically self-hosted and may be exposed via port forwarding, reverse proxies, or VPN endpoints. Shodan queries targeting the Runtipi web interface (e.g., default ports, HTTP banners, login page signatures) can identify candidate targets. The attacker then acquires valid credentials — through phishing, credential stuffing, or prior compromise of the operator's accounts.

Attack Chain:

1. Authentication and Backup Access: The attacker authenticates to the Runtipi web interface using the compromised credentials. They navigate to the backup/restore management functionality.

2. Crafting the Malicious Archive: The attacker constructs a backup archive (typically a .zip or .tar file) that contains a specially crafted entry: a symlink at the path user-config/app.env pointing to an arbitrary target path. Possible targets include:

   • /etc/cron.d/attacker (for scheduled code execution)
   • /opt/runtipi/.env (to alter application environment variables)
   • /home/runtipi/.ssh/authorized_keys (for persistent access)
   • Any web-root file served by applications managed by Runtipi

3. Restore Upload: The attacker uploads this crafted archive through the backup restore functionality. Runtipi extracts the archive and copies contents (including the malicious symlink) into the live application directory structure.

4. Triggering the Write Primitive: The attacker sends an HTTP PUT request to /api/user-config/demoapp3:_user with attacker-controlled appEnv content. The FilesystemService.writeTextFile() method resolves the path, follows the planted symlink, and writes the attacker's content to the target location.

5. Post-Exploitation: With arbitrary file write capability, the attacker can:

   • Inject a new cron job for scheduled command execution
   • Overwrite application configuration files to alter running services
   • Plant an SSH authorized key for persistent remote access
   • Modify orchestration state files to manipulate deployed containers
   • Degrade availability by corrupting critical system files

No public PoC exists at the time of this report. The attack chain is inferred from the vulnerability class (symlink following) and the specific technical details provided in the NVD description.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H yields a base score of 6.5 (Medium severity). This assessment reflects the following characteristics:

• Network Attack Vector (AV:N): The vulnerability can be exploited remotely over the network; local access to the target system is not required.
• Low Attack Complexity (AC:L): No special conditions, race conditions, or complex prerequisites are needed beyond preparing a malformed archive.
• High Privileges Required (PR:H): An attacker must possess valid authenticated credentials to the Runtipi interface.
• No User Interaction (UI:N): No victim action is required for exploitation.
• Unchanged Scope (S:U): The impact is confined to the Runtipi process and its execution context.
• No Confidentiality Impact (C:N): The flaw does not enable data exfiltration or read operations outside normal bounds.
• High Integrity Impact (I:H): Arbitrary file writes can modify critical system files, application configurations, or security-sensitive content (e.g., SSH keys, cron jobs).
• High Availability Impact (A:H): Overwriting critical files can cause service disruption, application failure, or complete denial of service.

The business impact for operators of Runtipi is significant. A homeserver orchestrator typically manages Docker containers, application data, and potentially sensitive personal services (media servers, file storage, home automation). A successful attack could result in:

• Persistent backdoor access to the host system
• Compromise of all services managed by Runtipi
• Data corruption requiring restoration from external backups
• Complete loss of availability of the homeserver infrastructure

The blast radius is limited to the Runtipi host and it's managed services; however, in a home network context, this could extend to other devices on the same LAN segment as the compromised host.

Detection Guidance

Sigma Rule

title: Runtipi Backup Restore Symlink Attack
id: 8f23a1c4-9e2b-4d76-8f3a-5b10c2e9d65a
status: experimental
description: Detects backup restore operations in Runtipi that may contain malicious symlinks, indicating attempted exploitation of CVE-2026-55168
author: valtersit.com Threat Intelligence
date: 2026/09/15
tags:
    - attack.t1190
    - cve.2026.55168
    - cwe.59
logsource:
    product: runtipi
    service: application
detection:
    selection_restore:
        EventID: 'backup.restore.started'
    selection_symlink:
        Action: 'backup.extract'
        ArchiveContainsSymlink: true
    selection_write:
        Action: 'file.write'
        TargetPath|endswith: 'user-config/app.env'
        SourceRequest: 'PUT /api/user-config/*'
    condition: selection_restore and selection_symlink or selection_write
falsepositives:
    - Legitimate backup archives that happen to contain symlinks (e.g., system configuration backups)
level: high

YARA Rule

rule CVE_2026_55168_Runtipi_Symlink_Backup
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects backup archives targeting Runtipi containing symlink entries for user-config/app.env"
        cve = "CVE-2026-55168"
        date = "2026-09-15"
        severity = "high"
    strings:
        $symlink_path = "user-config/app.env"
        $symlink_indicator_zip = "PK\x03\x04"  // ZIP magic bytes
        $symlink_indicator_tar = "ustar"        // TAR magic header
        $runtipi_marker = "runtipi"
        $config_section = "appEnv"
    condition:
        (uint32(0) == 0x04034b50 or $symlink_indicator_tar) and
        $symlink_path and
        1 of ($runtipi_marker, $config_section)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-55168 - Runtipi Backup Restore Symlink Exploitation Attempt"; flow:to_server,established; content:"PUT"; http_method; content:"/api/user-config/"; http_uri; content:"appEnv"; http_client_body; classtype:attempted-admin; sid:5516801; rev:1; metadata:cve CVE-2026-55168;)

Elastic Detection

sequence by host.name with maxspan=10m
  [ file where event.action == "extraction" and process.name == "runtipi" and
    file.path : "*user-config*" and
    file.Ext.symlink == true ]
  [ http where request.method == "PUT" and
    url.path : "/api/user-config/*" and
    contains(body, "appEnv") ]
  [ file where event.action == "write" and
    process.name == "runtipi" and
    file.path : "*user-config/app.env" ]

Splunk SPL Query

index=main sourcetype="runtipi:access" 
| search method=PUT uri="/api/user-config/*" 
| eval apienv=if(match(body, "appEnv"), 1, 0) 
| search apienv=1 
| transaction host maxspan=10m 
| search 
    [ search index=main sourcetype="runtipi:fileops" 
    | search action="extract" path="*user-config*" 
    | eval issymlink=if(match(metadata, "symlink"), 1, 0) 
    | search issymlink=1 ]
| table _time, host, src_ip, uri, body, target_path
| sort -_time

Wazuh OSSEC Rule

<group name="runtipi,">
  <rule id="551680" level="12">
    <decoded_as>json</decoded_as>
    <field name="log_type">access_log</field>
    <field name="method">PUT</field>
    <field name="uri">\.*\/api\/user-config\/.*</field>
    <description>Runtipi user-config PUT request — possible CVE-2026-55168 exploitation</description>
    <group>cve-2026-55168,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="551681" level="12">
    <decoded_as>json</decoded_as>
    <field name="log_type">file_operation</field>
    <field name="action">write_text_file</field>
    <field name="path">user-config/app.env</field>
    <description>Runtipi write to app.env via symlink — potential CVE-2026-55168 exploitation</description>
    <group>cve-2026-55168,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

As of this report's publication date, no patch evidence has been identified from any tracked independent source (GitHub advisories, vendor security announcements, NVD references, or third-party vulnerability databases). The NVD description states that the issue is fixed in version 4.10.1, but this has not yet been corroborated by additional sources.

Immediate Mitigations (until patch installation is verified):

1. Upgrade to Runtipi 4.10.1: If version 4.10.1 is available from the project's release channel, upgrade immediately. Verify the integrity of the downloaded package against the vendor's checksums/signatures.

2. Restrict Administrative Access: Limit access to the Runtipi web interface to trusted IP addresses or networks. Use VPN or SSH tunneling instead of exposing the interface directly to the internet.

3. Disable Backup Restore Feature: If upgrading is not immediately possible, disable or restrict access to the backup restore functionality. This eliminates the attack vector entirely, as the vulnerability requires the restore flow to plant the malicious symlink.

4. Enforce Strong Authentication: Ensure all Runtipi accounts use strong, unique passwords. Enable multi-factor authentication if supported. Audit and remove any unused accounts.

5. Network Segmentation: Isolate the Runtipi host from other critical network segments. Restrict outbound connections from the Runtipi host to only necessary services.

6. Monitor for Suspicious Activity: Deploy the detection rules provided above to alert on anomalous backup restore activity or unexpected file writes.

Patch/Upgrade Steps:

1. Download Runtipi 4.10.1 from the official releases page.
2. Stop the Runtipi service.
3. Back up current configuration (using a trusted backup method, not the vulnerable restore feature).
4. Install version 4.10.1 per vendor documentation.
5. Verify the symlink handling fix by attempting to restore a test archive containing a symlink (should be rejected or sanitized).
6. Restart services and verify normal operation.

Long-Term Hardening:

1. Principle of Least Privilege: Run the Runtipi process with the minimum required permissions. Restrict the process user's write access to only necessary directories.
2. Filesystem Hardening: Mount sensitive directories (e.g., /etc, /home, /opt) with restrictive mount options where feasible (read-only root filesystem, nosymlink mount option where applicable).
3. Registry and Archive Scanning: Implement scanning of uploaded archives for symlinks or unusual file types before restore operations.
4. Security Monitoring: Establish continuous monitoring of file system events around Runtipi's data directories, specifically watching for symlink creation or unexpected writes.
5. Regular Patching Cadence: Subscribe to Runtipi security announcements and maintain an automated patching schedule for the orchestrator and all managed services.
6. Backup Integrity Verification: Before restoring backups, verify archive contents against expected file lists. Maintain offline, immutable backups for disaster recovery scenarios.

References

1. NVD Entry: CVE-2026-55168 — https://nvd.nist.gov/vuln/detail/CVE-2026-55168
2. Runtipi GitHub Repository (for version 4.10.1 release notes) — https://github.com/runtipi/runtipi/releases
3. CWE-59: Improper Link Resolution Before File Access — https://cwe.mitre.org/data/definitions/59.html
4. MITRE ATT&CK Technique T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence has been identified at the time of this report. CVE-2026-55168 is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The lack of public exploit code reduces the immediate risk of mass exploitation, but the vulnerability's medium complexity and network exploitability make it an attractive target for targeted attacks against exposed Runtipi instances.