# CVE-2026-44716: Pipecat path traversal in development runner /files endpoint

Source: https://junglewise.ai/threats/cve-2026-44716-pipecat-path-traversal-in-development-runner-files-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-44716 · Severity: high · CVSS 7.5 · Published 2026-06-10

Pipecat is a framework for building voice and multimodal AI agents. A security flaw in its development runner allows unauthorized users to download any file from the server hosting the application. This could lead to the exposure of sensitive information such as private SSH keys, application credentials, and system configuration files, potentially compromising the entire server.

Technologies: [pipecat-ai (PyPI)](https://junglewise.ai/threats/technologies/pipecat-ai). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44716 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44716 being exploited in the wild.

**How severe is CVE-2026-44716?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** Pipecat AI Pipecat >= 0.0.90, < 1.2.0, >=0.0.90, <1.2.0; pipecat-ai (PyPI) >= 0.0.90, < 1.2.0, ECOSYSTEM:introduced=0.0.90,fixed=1.2.0.

**Is there a fix for CVE-2026-44716?** Yes. pipecat-ai (PyPI): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44716 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44716?** Check whether you run Pipecat AI Pipecat or pipecat-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pipecat-ai (PyPI): upgrade to 1.2.0 or later

  ```sh
  pip install "pipecat-ai>=1.2.0"
  ```


## Technical details

A path traversal vulnerability exists in the Pipecat development runner's `/files/{filename:path}` endpoint within `src/pipecat/runner/run.py`. The application fails to validate that the requested file resides within the intended directory because it concatenates the user-provided path directly to the base folder without using `.resolve()` or containment checks. While the underlying Starlette framework normalizes literal `../` sequences, it does not normalize `%2F` encoded slashes, which are decoded after routing. An unauthenticated remote attacker can use encoded traversal sequences (e.g., `..%2F..%2Fetc%2Fpasswd`) to read any file accessible to the Pipecat process. This issue is resolved in version 1.2.0 by implementing proper path resolution and containment validation.

## Affected products

- pipecat-ai pipecat-ai >= 0.0.90, < 1.2.0

## Identifiers

- CVE-2026-44716
- GHSA-3363-2ph6-35wh
- PYSEC-2026-2877

## Timeline

- 2026-04-29: other: Vulnerability confirmed by researcher
- 2026-05-15: disclosed
- 2026-05-15: advisory
- 2026-05-15: patched: Fixed in version 1.2.0

## References

- [https://api.github.com/users/AAtomical](https://api.github.com/users/AAtomical)
- [https://github.com/AAtomical](https://github.com/AAtomical)
- [https://api.github.com/users/AAtomical/gists%7B/gist_id%7D](https://api.github.com/users/AAtomical/gists%7B/gist_id%7D)
- [https://api.github.com/users/AAtomical/repos](https://api.github.com/users/AAtomical/repos)
- [https://avatars.githubusercontent.com/u/106249136?v=4](https://avatars.githubusercontent.com/u/106249136?v=4)
- [https://api.github.com/users/AAtomical/events%7B/privacy%7D](https://api.github.com/users/AAtomical/events%7B/privacy%7D)

## Related threats

- [Pipecat development runner unauthenticated session creation](https://junglewise.ai/threats/cve-2026-102682-pipecat-public-exposure-of-pipecat-s-development-runner-can)
- [Pipecat missing authorization in development runner WebSocket endpoints](https://junglewise.ai/threats/cve-2026-54695-pipecat-missing-authorization-in-development-runner-websocket)
- [Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer](https://junglewise.ai/threats/cve-2025-62373-pipecat-remote-code-execution-by-pickle-deserialization-through)