CVE-2026-29871 is a high-severity path traversal vulnerability affecting the Beifong AI News and Podcast Agent backend within the theunwindai awesome_llm_apps project. This flaw allows an unauthenticated attacker to manipulate a user-controlled path parameter in the stream-audio endpoint due to improper validation. With a CVSS score of 7.5, this vulnerability enables remote attackers to read arbitrary files from the server's filesystem, potentially exposing sensitive information such as configuration files and credentials. The attack requires no authentication or user interaction and has low attack complexity. While the vulnerability has garnered minimal community discussion and has a very low EPSS score, there are currently no known public exploits, Metasploit modules, or evidence of active exploitation, and it is not listed on the CISA KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2026-01-19CPE matchmatch criteria | cpe:2.3:a:theunwindai:awesome_llm_apps:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.