Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
Date: 2026-05
Affected: pip/pipecat-ai
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-44716
CWE: CWE-22
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

## Summary A path traversal vulnerability exists in Pipecat's development runner (`src/pipecat/runner/run.py`). When the runner is started with the `--folder` flag, it exposes a `GET /files/{filename:path}` download endpoint. The `filename` path parameter is concatenated directly onto `args.folder` with no containment check. Starlette normalises literal `../` sequences in URLs, but `%2F`-encoded slashes bypass this normalisation: the path parameter is URL-decoded *after* routing, so `..%2F..%2Fetc%2Fpasswd` resolves to a path two levels above `args.folder`. An attacker with network access to the runner can read any file the pipecat process has permission to access — including SSH private keys, credentials, and system files — with a single unauthenticated HTTP request. Confirmed on **pipecat-ai 1.1.0** (latest PyPI release) and commit `f078df78058ae82a02ce5b23e9e3a99a0917a53d`. --- ## Details The vulnerable code is in `src/pipecat/runner/run.py`, inside the `_configure_server_app()` function, lines 249–264: ```python @app.get("/files/{filename:path}") async def download_file(filename: str): """Handle file downloads.""" if not args.folder: logger.warning(f"Attempting to dowload {filename}, but downloads folder not setup.") return file_path = Path(args.folder) / filename # ← no containment check if not os.path.exists(file_path): raise HTTPException(404) media_type, _ = mimetypes.guess_type(file_path) return FileRe


Mitigations:

Architectural layers (MAESTRO):