Executive brief
Pipecat is a framework for building voice and multimodal AI agents. A security flaw in its development runner allows unauthorized users to download any file from the server hosting the application. This could lead to the exposure of sensitive information such as private SSH keys, application credentials, and system configuration files, potentially compromising the entire server.
Technical details
A path traversal vulnerability exists in the Pipecat development runner's `/files/{filename:path}` endpoint within `src/pipecat/runner/run.py`. The application fails to validate that the requested file resides within the intended directory because it concatenates the user-provided path directly to the base folder without using `.resolve()` or containment checks. While the underlying Starlette framework normalizes literal `../` sequences, it does not normalize `%2F` encoded slashes, which are decoded after routing. An unauthenticated remote attacker can use encoded traversal sequences (e.g., `..%2F..%2Fetc%2Fpasswd`) to read any file accessible to the Pipecat process. This issue is resolved in version 1.2.0 by implementing proper path resolution and containment validation.
Affected products
- pipecat-ai pipecat-ai >= 0.0.90, < 1.2.0
Timeline
- 2026-04-29: other: Vulnerability confirmed by researcher
- 2026-05-15: disclosed
- 2026-05-15: advisory
- 2026-05-15: patched: Fixed in version 1.2.0