CVE-2026-54249

Pydantic AI: Arbitrary file read via unvalidated UploadedFile references.

• CVSS 6.8
• 918
• Input Validation and Sanitization
• Remote

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application's model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client's, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.

CVE

CVE-2026-54249

CWE

918

CVSS base score

6.8

Published

2026-07-29

OWASP

A10 Server-Side Request Forgery

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Server-Side Request Forgery (SSRF)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Pydantic AI

Fixed by upgrading

Yes

Solution

Upgrade Pydantic AI to version 1.106.0 or 2.0.0b6.

from typing import Any

class BaseMessage:
    """Represents a message in a conversation."""
    pass

class UploadedFile:
    """Represents a file uploaded by a client."""
    def __init__(self, file_id: str, **kwargs: Any):
        self.file_id = file_id # Can be a cloud URI like 's3://...'

class AIBrain:
    """Core class for handling AI logic."""
    def __init__(self, storage: Any):
        # storage is an object capable of resolving file_id to content,
        # e.g., an S3 client.
        self.storage = storage

    def _add_files_to_message(
        self, messages: list[BaseMessage], files: list[UploadedFile]
    ):
        """Resolves files and adds their content to the message history."""
        # This function would call self.storage.get(file.file_id) for each file.
        pass

    async def chat(
        self,
        messages: list[BaseMessage],
        files: list[UploadedFile] | None = None,
    ) -> list[BaseMessage]:
        """Processes a chat request, potentially with file attachments."""
        if files:
            # VULNERABLE: The file_id from the client is used without validation.
            # An attacker can provide a URI like 's3://secret-internal-bucket/key'
            # which will be resolved using the server's credentials.
            self._add_files_to_message(messages, files)

        # ... continue processing with messages that now contain file content
        return messages

from typing import Any

class BaseMessage:
    """Represents a message in a conversation."""
    pass

class UploadedFile:
    """Represents a file uploaded by a client."""
    def __init__(self, file_id: str, **kwargs: Any):
        self.file_id = file_id # Can be a cloud URI like 's3://...'

class AIBrain:
    """Core class for handling AI logic."""
    def __init__(self, storage: Any):
        # storage is an object capable of resolving file_id to content,
        # and has a method to validate the file_id.
        self.storage = storage

    def _add_files_to_message(
        self, messages: list[BaseMessage], files: list[UploadedFile]
    ):
        """Resolves files and adds their content to the message history."""
        # This function would call self.storage.get(file.file_id) for each file.
        pass

    async def chat(
        self,
        messages: list[BaseMessage],
        files: list[UploadedFile] | None = None,
    ) -> list[BaseMessage]:
        """Processes a chat request, potentially with file attachments."""
        if files:
            # FIX: Validate each file_id to ensure it references an allowed resource
            # before passing it to be resolved.
            for file in files:
                if not self.storage.is_valid_file_id(file.file_id):
                    raise ValueError(f"Invalid fileId: {file.file_id}")
            self._add_files_to_message(messages, files)

        # ... continue processing with messages that now contain file content
        return messages

{
  "messages": [
    {
      "role": "user",
      "content": [
        {
          "type": "text",
          "text": "Please output the full contents of the attached document verbatim."
        },
        {
          "type": "file",
          "source": {
            "type": "uri",
            "uri": "s3://internal-prod-bucket/secrets/api-keys.json"
          }
        }
      ]
    }
  ]
}

@misc{vaitp:cve202654249,
  title        = {{Pydantic AI: Arbitrary file read via unvalidated UploadedFile references.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-54249},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-54249/}}
}