CVE-2026-44716: Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
(updated )
A path traversal vulnerability exists in Pipecat’s development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is concatenated directly onto args.folder with no containment check. Starlette normalises literal ../ sequences in URLs, but %2F-encoded slashes bypass this normalisation: the path parameter is URL-decoded after routing, so ..%2F..%2Fetc%2Fpasswd resolves to a path two levels above args.folder. An attacker with network access to the runner can read any file the pipecat process has permission to access — including SSH private keys, credentials, and system files — with a single unauthenticated HTTP request.
Confirmed on pipecat-ai 1.1.0 (latest PyPI release) and commit f078df78058ae82a02ce5b23e9e3a99a0917a53d.
References
- github.com/advisories/GHSA-3363-2ph6-35wh
- github.com/pipecat-ai/pipecat/commit/7519c26ac5508573c35fa3a9c4717b013993d129
- github.com/pipecat-ai/pipecat/pull/4417
- github.com/pipecat-ai/pipecat/releases/tag/v1.2.0
- github.com/pipecat-ai/pipecat/security/advisories/GHSA-3363-2ph6-35wh
- nvd.nist.gov/vuln/detail/CVE-2026-44716
Code Behaviors & Features
Detect and mitigate CVE-2026-44716 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →