Is CVE-2026-44716 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44716 being exploited in the wild.

How severe is CVE-2026-44716?

High severity, with a CVSS score of 7.5, published 10 June 2026.

Which products and versions are affected?

Pipecat AI Pipecat >= 0.0.90, =0.0.90, = 0.0.90, < 1.2.0, ECOSYSTEM:introduced=0.0.90,fixed=1.2.0.

Is there a fix for CVE-2026-44716?

Yes. pipecat-ai (PyPI): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44716 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44716?

Check whether you run Pipecat AI Pipecat or pipecat-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44716: Pipecat path traversal in development runner /files endpoint

Q: Is there a fix for CVE-2026-44716?

Yes. pipecat-ai (PyPI): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44716 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44716?

Check whether you run Pipecat AI Pipecat or pipecat-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44716 · Severity: high · CVSS 7.5 · Published 2026-06-10

Pipecat is a framework for building voice and multimodal AI agents. A security flaw in its development runner allows unauthorized users to download any file from the server hosting the application. This could lead to the exposure of sensitive information such as private SSH keys, application credentials, and system configuration files, potentially compromising the entire server.

Technologies: pipecat-ai (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44716 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44716 being exploited in the wild.
How severe is CVE-2026-44716?: High severity, with a CVSS score of 7.5, published 10 June 2026.
Which products and versions are affected?: Pipecat AI Pipecat >= 0.0.90, < 1.2.0, >=0.0.90, <1.2.0; pipecat-ai (PyPI) >= 0.0.90, < 1.2.0, ECOSYSTEM:introduced=0.0.90,fixed=1.2.0.
Is there a fix for CVE-2026-44716?: Yes. pipecat-ai (PyPI): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44716 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44716?: Check whether you run Pipecat AI Pipecat or pipecat-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pipecat-ai (PyPI): upgrade to 1.2.0 or later
```
pip install "pipecat-ai>=1.2.0"
```

Technical details

A path traversal vulnerability exists in the Pipecat development runner's `/files/{filename:path}` endpoint within `src/pipecat/runner/run.py`. The application fails to validate that the requested file resides within the intended directory because it concatenates the user-provided path directly to the base folder without using `.resolve()` or containment checks. While the underlying Starlette framework normalizes literal `../` sequences, it does not normalize `%2F` encoded slashes, which are decoded after routing. An unauthenticated remote attacker can use encoded traversal sequences (e.g., `..%2F..%2Fetc%2Fpasswd`) to read any file accessible to the Pipecat process. This issue is resolved in version 1.2.0 by implementing proper path resolution and containment validation.

Affected products

pipecat-ai pipecat-ai >= 0.0.90, < 1.2.0

Identifiers

CVE-2026-44716
GHSA-3363-2ph6-35wh
PYSEC-2026-2877

Timeline

2026-04-29: other: Vulnerability confirmed by researcher
2026-05-15: disclosed
2026-05-15: advisory
2026-05-15: patched: Fixed in version 1.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.