HighVulnerability
GHSA-3363-2ph6-35wh: Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
- Identifiers
- CVE-2026-44716GHSA-3363-2ph6-35wh
- Published
- Record updated
- Affected
- pipecat-ai >= 0.0.90, < 1.2.0
- Fixed in
- 1.2.0
- released May 14, 2026, 1 day before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
Pipecat's development runner, started with the --folder flag, exposes a GET /files/{filename:path} endpoint in src/pipecat/runner/run.py that joins the filename directly onto args.folder without a containment check. Starlette decodes %2F after routing, so a request such as ..%2F..%2Fetc%2Fpasswd escapes the folder, and the endpoint has no authentication. The advisory confirms this on pipecat-ai 1.1.0 and commit f078df78058ae82a02ce5b23e9e3a99a0917a53d.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- pipecat-aiPyPILLM dependency since 2024-05-13 · 1 tracked dependent
Related items
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
- MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
- HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
- InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek