CVE-2026-29871: A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52ac

Q: How do I fix CVE-2026-29871?

awesome llm apps: upgrade to 2026-01-19. Exact commands for each OS are on this page.

Q: Is CVE-2026-29871 being exploited?

CVE-2026-29871 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-29871 affect?

CVE-2026-29871 affects awesome llm apps. Severity is high (CVSS 7.5). A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file router

Q: How urgent is CVE-2026-29871?

Priority 48/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action

This week

HIGH 7.5REMOTEUPGRADE

CVE-2026-29871 is a high-severity flaw (CVSS 7.5) affecting awesome llm apps. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file routers/podcast_router.py, in function stream_audio. The stream-audio endpoint accepts a user-controlled path parameter that is concatenated into a filesystem path without proper validation or restriction. An unauthe

Why this priority

High severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.6% (top 53%)
CISA exploited list	No
Weakness	CWE-22
Published	2026-03-27
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: theunwindai

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-03-27 15:16 UTCPublished CVE record published
2026-06-17 10:29 UTCUpdated Record last modified

theunwindai awesome llm apps UPGRADE

Affected: < 2026-01-19

Fixed in: 2026-01-19

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy awesome-llm-apps || rpm -q awesome-llm-apps || awesome-llm-apps --version

2. UPGRADE to 2026-01-19 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade awesome-llm-apps

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade awesome-llm-apps

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-29871?

awesome llm apps: upgrade to 2026-01-19. Exact commands for each OS are on this page.

Is CVE-2026-29871 being exploited?

CVE-2026-29871 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-29871 affect?

CVE-2026-29871 affects awesome llm apps. Severity is high (CVSS 7.5). A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file router

How urgent is CVE-2026-29871?

Priority 48/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action

Software pages

FastAPI vulnerabilities

Related CVEs

CVE-2026-29872 HIGH 8.2 DOWNGRADE A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f9

References

← Back to latest CVEs