A critical path traversal vulnerability in Runtipi versions 4.5.0 through 4.7.1 allows unauthenticated remote attackers to achieve full remote code execution and host filesystem compromise.

This is a path traversal and missing authentication flaw within the UserConfigController. An unauthenticated attacker can exploit insecure URN parsing to overwrite the system configuration, enabling arbitrary code execution upon the next service restart.

The ability for an unauthenticated user to achieve remote code execution on a homeserver orchestrator poses a severe risk to data integrity and system availability. Successful exploitation grants the attacker control over the host filesystem, potentially leading to total system compromise, unauthorized access to hosted applications, and the loss of sensitive user data. The CVSS score of 7.6 reflects the high potential for impact on the confidentiality, integrity, and availability of the host environment.

Immediate Action: Update Runtipi to version 4.7.2 or later immediately to patch the insecure URN parsing logic.

Proactive Monitoring: Review system configuration files for unexpected changes and audit server logs for unusual requests directed at the UserConfigController endpoint.

Compensating Controls: Implement strict network access controls to restrict access to the Runtipi management interface to trusted IP addresses only, reducing the attack surface for remote exploitation.

Public Exploit Available: Unknown

Given the potential for full system compromise, administrators must prioritize the update to version 4.7.2. This vulnerability represents a significant security oversight that allows unauthenticated actors to gain control over the host environment, making immediate patching the only effective method to fully mitigate the risk of remote code execution.