In Runtipi versions 4.10.0 and earlier an attacker with authentication can embed symbolic links in a backup archive. During restore the backup handler copies these symlinked paths into the live application directories; the internal FilesystemService.writeTextFile() function follows the link, which allows the attacker to write arbitrary content to a location outside the intended user‑configuration directory. This flaw can be used to overwrite configuration files, place malicious scripts, or otherwise tamper with the host filesystem, potentially leading to privilege escalation or persistent compromise. The weakness is distinctively a path traversal and symlink exploitation, reflected by the associated CWE-59 and CWE-61 identifiers.

Any instance of Runtipi running version 4.10.0 or earlier is affected; the vulnerability resides in the backup restore flow of these releases.

The CVSS score of 6.5 marks moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV catalog. Exploitation requires HTTP authentication to access the /api/user‑config endpoint and the ability to trigger a backup restore operation. No additional OS privileges are needed beyond the credentials of the authenticated user. The exploit path is relatively straightforward: a malicious backup archive is uploaded and the symlinked file is written during the restore, enabling arbitrary file write with the permissions of the Runtipi process.