HighVulnerability
CVE-2026-29871: awesome-llm-apps path traversal in stream-audio endpoint of FastAPI backend
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-29871
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.6%
Summary
CVE-2026-29871 is a path traversal vulnerability in the awesome-llm-apps project at commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19), in the Beifong AI News and Podcast Agent FastAPI backend. The stream_audio function in routers/podcast_router.py, reached through the stream-audio endpoint, concatenates a user-controlled path parameter into a filesystem path without validation or restriction. An unauthenticated remote attacker can read arbitrary files from the server filesystem, potentially exposing configuration files and credentials.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
- HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
- MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News