CVE-2026-55168

Repository is a small standalone Python proof-of-concept for CVE-2026-55168 affecting Runtipi. It contains two files: a README describing the vulnerability and usage, and a single executable script, poc.py, which is the exploit entry point. The exploit is authenticated and web-based: it logs into a target Runtipi instance using supplied credentials, builds an in-memory tar archive compressed with gzip, and inserts a symlink entry user-config/app.env pointing to an attacker-chosen filesystem path (default /data/state/proof.txt). It then uploads this archive to the backup endpoint for a chosen app URN, triggers the restore flow, waits 8 seconds, and finally sends a normal user-config update request with attacker-controlled appEnv content. Because the restored symlink is followed during the later write, the script achieves arbitrary file write outside the intended application directory. The code uses Python standard libraries only (argparse, tarfile, gzip, urllib, cookiejar, json, re, time), maintains session cookies after login, and sets Origin/Referer/X-Forwarded-* headers to resemble expected application traffic. This is a real exploit PoC rather than a detector: it performs the full exploitation chain and demonstrates successful compromise by writing controlled content to a target file.