CVE-2026-29871 Details

A path traversal vulnerability has been identified in the Beifong AI News and Podcast Agent backend of the awesome-llm-apps project, specifically in commit e46690f99c3f08be80a9877fab52acacf7ab8251. The vulnerability exists in the FastAPI backend, within the stream-audio endpoint of the podcast_router.py file. The issue arises because the endpoint accepts a user-controlled path parameter that is directly concatenated into a filesystem path without adequate validation or restrictions. This flaw enables an unauthenticated remote attacker to exploit the vulnerability and read arbitrary files from the server's filesystem, potentially exposing sensitive information such as configuration files and credentials.

To address this vulnerability, the path traversal issue can be mitigated by implementing proper path validation and normalization. A recommended fix involves using the pathlib library to resolve the requested file path and ensure it remains within the intended directory before serving the file.