Pipecat’s development runner exposes a GET /files endpoint when started with the --folder flag. The filename path is concatenated directly onto the folder path without containment checks. Because Starlette normalises literal '..' sequences after routing, but %2F-encoded slashes are decoded after routing, an attacker can craft a request such as /files/..%2F..%2Fetc%2Fpasswd to read files two levels above the configured folder. The result is that any file the pipecat process can read, including SSH private keys and system configuration files, becomes available to an unauthenticated user. This allows an attacker to compromise confidentiality and potentially leverage the accessed data for further exploits.

The vulnerability exists in the open‑source Pipecat framework provided by pipecat-ai. Version ranges 0.0.90 through 1.1.x (inclusive) are affected because the development runner (src/pipecat/runner/run.py) contains the unchecked path concatenation. The issue was fixed in version 1.2.0, which removes the vulnerable endpoint when the --folder option is omitted or otherwise restricts file access.

The CVSS score of 7.5 indicates a high severity vulnerability. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalogue. Because the endpoint is an HTTP GET request with no authentication, an attacker who can reach the Pipecat runner over the network can exploit the flaw immediately. The primary risk is arbitrary file read, potentially exposing sensitive system credentials and private keys that the service process can access.