7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44716

CVE-2026-44716: Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat's development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is concatenated directly onto args.folder with no containment check. Starlette normalises literal ../ sequences in URLs, but %2F-encoded slashes bypass this normalisation: the path parameter is URL-decoded after routing, so ..%2F..%2Fetc%2Fpasswd resolves to a path two levels above args.folder. An attacker with network access to the runner can read any file the pipecat process has permission to access — including SSH private keys, credentials, and system files — with a single unauthenticated HTTP request. This issue has been patched in version 1.2.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44716

CVE-2026-44716:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pipecat-ai	pip	>= 0.0.90, < 1.2.0	1.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the download_file function located within src/pipecat/runner/run.py. This function acts as a route handler for the /files/{filename:path} endpoint. The core of the vulnerability lies in the unsafe handling of the filename path parameter. The code originally took the filename and directly joined it with a base folder path using pathlib.Path. However, it failed to validate or sanitize the input filename. Web frameworks like Starlette (used by FastAPI) normalize paths containing ../, but they decode URL-encoded characters like %2F after the routing and path matching is complete. This allows an attacker to craft a malicious filename such as ..%2F..%2Fetc%2Fpasswd. When the download_file function receives this, the %2F has been decoded to /, resulting in a path traversal (../../etc/passwd) that allows reading arbitrary files outside of the intended downloads folder. The patch commit 7519c26ac5508573c35fa3a9c4717b013993d129 confirms this by replacing the insecure path concatenation with a call to a new _resolve_download_path function, which explicitly resolves the path and performs a containment check to ensure the final path is within the allowed base directory, thus mitigating the path traversal vulnerability.

Vulnerable functions

download_file

src/pipecat/runner/run.py

The `download_file` function is a FastAPI route handler that takes a `filename` from the URL. The original implementation directly concatenated this user-provided `filename` to a base directory path (`args.folder`). It did not sanitize the `filename` or check for path traversal sequences. This allowed an attacker to use URL-encoded characters like `%2F` (for `/`) to construct paths like `..%2F..%2Fetc%2Fpasswd`, bypassing the web server's normal path validation and reading arbitrary files from the server's filesystem.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.