Pipecat, an open-source Python framework for conversational agents, has a path traversal vulnerability (CWE-22) in its development runner (src/pipecat/runner/run.py) when started with the --folder flag. The GET /files/{filename:path} endpoint concatenates the filename parameter directly onto the folder path without containment checks. Although Starlette normalizes literal '../' sequences, URL-encoded slashes (%2F) bypass this normalization, allowing traversal above the intended directory. This enables an unauthenticated remote attacker to read any file the pipecat process can access, including sensitive system files and credentials. The issue is patched in version 1.2.0.

An attacker with network access to the vulnerable Pipecat development runner can perform unauthenticated arbitrary file reads on the host system within the permissions of the pipecat process. This can lead to disclosure of sensitive information such as SSH private keys, credentials, and system files. There is no impact on integrity or availability reported.

This vulnerability is fixed in Pipecat version 1.2.0. Users should upgrade to version 1.2.0 or later to remediate this issue. No official patch or temporary workaround is documented. Until upgraded, avoid exposing the development runner with the --folder flag to untrusted networks.