Arbitrary Code Execution Vulnerability in Runtipi Docker-Based Personal Homeserver

CVE-2026-24129

What is CVE-2026-24129?

Runtipi, a personal homeserver orchestrator running in Docker, is impacted by a critical flaw that allows an authenticated user to execute arbitrary system commands. This vulnerability arises from the BackupManager component, which fails to sanitize backup filenames uploaded by users. Attackers can exploit this weakness by injecting shell metacharacters into these filenames, enabling them to place malicious files in predictable locations on the host server. When these files are subsequently referenced during restore operations, the system may execute the injected commands. This issue underscores the importance of file validation and sanitization in backup management systems. The vulnerability has been resolved in version 4.7.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References