A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the Beifong AI News and…

A path traversal vulnerability exists in the awesome-llm-apps project allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. The vulnerability is located in the Beifong AI News and Podcast Agent backend's FastAPI stream-audio endpoint in the stream_audio function. The endpoint accepts user-controlled path parameters that are concatenated into filesystem paths without proper validation. Attackers can exploit this to access sensitive information including configuration files and credentials. The vulnerability affects commit e46690f99c3f08be80a9877fab52acacf7ab8251 from January 19, 2026.