runtipi

v4.10.1 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 1mo Home Automation

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

homeserver linux self-hosted

Affected surfaces

rce_ssrf breaking_upgrade

ReleasePort's take

Light signal

editorial:auto 1mo

Backup restore now validates archives and rejects unsafe or unsupported entries before touching live files.

Why it matters: Prevents corruption of production data by blocking invalid, unsafe archives; severity flagged at 40 for backup‑restore processes.

Summary

AI summary

Backup restore now rejects invalid, unsafe archives and unsupported entries before modifying live files.

Changes in this release

Type	Severity	Summary	CVE
Bugfix
Bugfix	Medium	Backup restore now rejects invalid or unsafe archives before replacing live app files Backup restore now rejects invalid or unsafe archives before replacing live app files Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Backup restore now rejects unsupported archive entries, unsafe symlinks, path traversal attempts, and unsafe hardlinks Backup restore now rejects unsupported archive entries, unsafe symlinks, path traversal attempts, and unsafe hardlinks Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Temporary restore folders are cleaned up when backup validation or extraction fails Temporary restore folders are cleaned up when backup validation or extraction fails Source: llm_adapter@2026-06-10 Confidence: high	—

Full changelog

Release notes

Improvements

Backup restore now rejects invalid or unsafe archives before replacing live app files
Backup restore now rejects unsupported archive entries, unsafe symlinks, path traversal attempts, and unsafe hardlinks
Temporary restore folders are now cleaned up when backup validation or extraction fails

How to update

From the root folder of your runtipi install

./runtipi-cli update v4.10.1

If you are coming from version 3 or lower please follow the migration guide

Breaking Changes

Backup restore rejects invalid or unsafe archives before replacing live app files

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track runtipi

Get notified when new releases ship.

About runtipi

Runtipi is a homeserver for everyone! One command setup, one click installs for your favorites self-hosted apps.

All releases →