Runtipi vulnerabilities
We track 4 vulnerabilities in Runtipi products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 16, 2026.
Latest Runtipi vulnerabilities
- 8.8 High severity
runtipi: Improper Restriction of Excessive Authentication Attempts
Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (via phishing,
- 9.8 Critical severity
runtipi: Missing Authentication for Critical Functionality
Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin) password when a password-reset request is active, resulting in full account takeover. The endpoint POST /api/auth/reset-password is expose
- 8.8 High severity
runtipi: Improper Limitation of a Pathname to a Restricted Directory
Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `UserConfigController` allows any remote user to overwrite the system's `docker-compose.yml` configurati
- 8.8 High severity
runtipi: Improper Neutralization of Special Elements used in an OS Command
Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server by injecting shell metacharacters in