Vulnerability Details CVE-2026-44716
Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat's development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is concatenated directly onto args.folder with no containment check. Starlette normalises literal ../ sequences in URLs, but %2F-encoded slashes bypass this normalisation: the path parameter is URL-decoded after routing, so ..%2F..%2Fetc%2Fpasswd resolves to a path two levels above args.folder. An attacker with network access to the runner can read any file the pipecat process has permission to access — including SSH private keys, credentials, and system files — with a single unauthenticated HTTP request. This issue has been patched in version 1.2.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 18.5%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-44716
-
cpe:2.3:a:pipecat:pipecat:0.0.100
-
cpe:2.3:a:pipecat:pipecat:0.0.101
-
cpe:2.3:a:pipecat:pipecat:0.0.102
-
cpe:2.3:a:pipecat:pipecat:0.0.103
-
cpe:2.3:a:pipecat:pipecat:0.0.104
-
cpe:2.3:a:pipecat:pipecat:0.0.105
-
cpe:2.3:a:pipecat:pipecat:0.0.106
-
cpe:2.3:a:pipecat:pipecat:0.0.107
-
cpe:2.3:a:pipecat:pipecat:0.0.108
-
cpe:2.3:a:pipecat:pipecat:0.0.90
-
cpe:2.3:a:pipecat:pipecat:0.0.91
-
cpe:2.3:a:pipecat:pipecat:0.0.92
-
cpe:2.3:a:pipecat:pipecat:0.0.93
-
cpe:2.3:a:pipecat:pipecat:0.0.94
-
cpe:2.3:a:pipecat:pipecat:0.0.95
-
cpe:2.3:a:pipecat:pipecat:0.0.96
-
cpe:2.3:a:pipecat:pipecat:0.0.97
-
cpe:2.3:a:pipecat:pipecat:0.0.98
-
cpe:2.3:a:pipecat:pipecat:0.0.99
-
cpe:2.3:a:pipecat:pipecat:1.0.0
-
cpe:2.3:a:pipecat:pipecat:1.1.0