https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 07:30:27 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44716 <p><strong>Affected:</strong> pipecat-ai pipecat</p> <p>Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat&#39;s development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is concatenated directly onto args.folder with no containment check. Starlette normalises literal ../ sequences in URLs, but %2F-encoded slashes bypass this normalisation: the path parameter is URL-decoded after routing, so ..%2F..%2Fetc%2Fpasswd resolves to a path two levels above args.folder. An attacker with network access to the runner can read any file the pipecat process has permission to access — including SSH private keys, credentials, and system files — with a single unauthenticated HTTP request. This issue has been patched in version 1.2.0.</p> <p><strong>Affected:</strong> pipecat-ai pipecat</p> <p>Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat&#39;s development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is concatenated directly onto args.folder with no containment check. Starlette normalises literal ../ sequences in URLs, but %2F-encoded slashes bypass this normalisation: the path parameter is URL-decoded after routing, so ..%2F..%2Fetc%2Fpasswd resolves to a path two levels above args.folder. An attacker with network access to the runner can read any file the pipecat process has permission to access — including SSH private keys, credentials, and system files — with a single unauthenticated HTTP request. This issue has been patched in version 1.2.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-44716 https://cve.radiocsirt.org/vuln/pysec-2026-2877 <p><strong>Affected:</strong> PyPI: pipecat-ai</p> <p>## Summary</p> <p>A path traversal vulnerability exists in Pipecat&#39;s development runner (`src/pipecat/runner/run.py`). When the runner is started with the `--folder` flag, it exposes a `GET /files/{filename:path}` download endpoint. The `filename` path parameter is concatenated directly onto `args.folder` with no containment check. Starlette normalises literal `../` sequences in URLs, but `%2F`-encoded slashes bypass this normalisation: the path parameter is URL-decoded *after* routing, so `..%2F..%2Fetc%2Fpasswd` resolves to a path two levels above `args.folder`. An attacker with network access to the runner can read any file the pipecat process has permission to access — including SSH private keys, credentials, and system files — with a single unauthenticated HTTP request.</p> <p>Confirmed on **pipecat-ai 1.1.0** (latest PyPI release) and commit `f078df78058ae82a02ce5b23e9e3a99a0917a53d`.</p> <p>---</p> <p>## Details</p> <p>The vulnerable code is in `src/pipecat/runner/run.py`, inside the `_configure_server_app()` function, lines 249–264:</p> <p>```python @app.get(&#34;/files/{filename:path}&#34;) async def download_file(filename: str): &#34;&#34;&#34;Handle file downloads.&#34;&#34;&#34; if not args.folder: logger.warning(f&#34;Attempting to dowload {filename}, but downloads folder not setup.&#34;) return</p> <p>file_path = Path(args.folder) / filename # ← no containment check if not os.path.exists(file_path): raise HTTPException(404)</p> <p>media_type, _ = mimetypes.guess_type(file_path)</p> <p>return FileR…</p> <p><strong>Affected:</strong> PyPI: pipecat-ai</p> <p>## Summary</p> <p>A path traversal vulnerability exists in Pipecat&#39;s development runner (`src/pipecat/runner/run.py`). When the runner is started with the `--folder` flag, it exposes a `GET /files/{filename:path}` download endpoint. The `filename` path parameter is concatenated directly onto `args.folder` with no containment check. Starlette normalises literal `../` sequences in URLs, but `%2F`-encoded slashes bypass this normalisation: the path parameter is URL-decoded *after* routing, so `..%2F..%2Fetc%2Fpasswd` resolves to a path two levels above `args.folder`. An attacker with network access to the runner can read any file the pipecat process has permission to access — including SSH private keys, credentials, and system files — with a single unauthenticated HTTP request.</p> <p>Confirmed on **pipecat-ai 1.1.0** (latest PyPI release) and commit `f078df78058ae82a02ce5b23e9e3a99a0917a53d`.</p> <p>---</p> <p>## Details</p> <p>The vulnerable code is in `src/pipecat/runner/run.py`, inside the `_configure_server_app()` function, lines 249–264:</p> <p>```python @app.get(&#34;/files/{filename:path}&#34;) async def download_file(filename: str): &#34;&#34;&#34;Handle file downloads.&#34;&#34;&#34; if not args.folder: logger.warning(f&#34;Attempting to dowload {filename}, but downloads folder not setup.&#34;) return</p> <p>file_path = Path(args.folder) / filename # ← no containment check if not os.path.exists(file_path): raise HTTPException(404)</p> <p>media_type, _ = mimetypes.guess_type(file_path)</p> <p>return FileR…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2877