The UserConfigController in Runtipi is vulnerable to an unauthenticated path traversal exploit that allows an attacker to overwrite the system's docker‑compose.yml file. By manipulating URN parsing, the attacker can inject a malicious stack configuration, which will be executed the next time the instance restarts, giving complete control over the host.

Affected versions include Runtipi releases from 4.5.0 through 4.7.1. Version 4.7.2 and later contain a fix that removes the vulnerable parsing logic. The product is an open‑source personal homeserver orchestrator that runs container stacks for home users.

The CVSS v3.1 score of 7.6 signals high severity, while an EPSS score of less than 1% indicates a low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploit yet. However, the path traversal component (CWE‑22) and lack of authentication (CWE‑306) make the attack straightforward from any remote client that can reach the API endpoint.