Advisories · Technology
runtipi.
Every CVE that names runtipi among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Runtipi: Authenticated arbitrary file write via backup restore symlink planting
- runtipi
- Path traversal
- CWE-61
- CVSS 6.5 Medium
Runtipi: Unauthenticated arbitrary file read through app-store logo symlinks
- runtipi
- Path traversal
- CVSS 8.1 High
Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`
- runtipi
- Authentication bypass
- CWE-799
- CVSS 7.7 High
Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window
- runtipi
- Authentication bypass
- CVSS 7.6 High
Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal
- runtipi
- Path traversal
- Authentication bypass
- CVSS 8.1 High
Runtipi is Vulnerable to Authenticated Arbitrary Remote Code Execution
- runtipi
- Command injection