Pydantic AI UploadedFile Reference SSRF/Arbitrary File Read via Unvalidated Message History
First seen Jul 30, 2026 · Updated Jul 30, 2026 · CVSS 6.8
Pydantic AI's UI adapters (e.g., the Vercel AI adapter) accept client-submitted message history containing 'UploadedFile' references, such as S3/GCS URIs or provider file IDs, without validating that the requesting client should have access to them. Because the server resolves these references using its own privileged credentials (IAM role, service account, or API key), an attacker who can guess or obtain a valid file identifier can trick the server into reading files it should not have access to on the attacker's behalf, including data belonging to other tenants. This is a classic confused-deputy vulnerability affecting a widely used Python agent framework, fixed in versions 1.106.0 and 2.0.0b6.
Technical Analysis
The entry point is the message history payload submitted by a client to a Pydantic AI UI adapter; while raw file URL parts are checked against a scheme allowlist, the UploadedFile abstraction (provider file ID or cloud-storage URI like s3:// or gs://) bypasses this validation and is forwarded unchecked to the model provider. The provider then resolves the reference using the server's own credentials rather than the client's, creating a server-side confused-deputy condition: the client dictates *what* file to fetch, but the server supplies the privileged identity that fetches it. This crosses a trust boundary between the client-facing agent interface and the backend's cloud-storage/model-provider account, allowing cross-tenant or cross-application file disclosure if file identifiers are guessable or predictable (e.g., sequential IDs or non-random object naming). The attacker gains read access to potentially sensitive uploaded files, documents, or provider-hosted artifacts without needing direct storage credentials, purely by manipulating conversational/message-history state passed to the agent framework.
Affected Systems
Pydantic AI, Vercel AI adapter
Detection Signatures
- Message history payloads containing UploadedFile-type references with s3:// or gs:// URIs or provider file IDs not originated by the current session/user
- Requests where client-supplied file identifiers do not match files previously issued to that session
- Unusual volume of UploadedFile resolution requests referencing sequential or pattern-guessable object keys
- Server-side logs showing model-provider file reads correlated with client-controlled message history fields rather than server-issued upload tokens
- Anomalous cross-tenant file access in multi-tenant deployments of Pydantic AI-based applications
Remediation Steps
- 1
Upgrade Pydantic AI
Update to version 1.106.0, 2.0.0b6, or later where UploadedFile references are validated before being forwarded to the provider.
- 2
Validate ownership of file references
Implement server-side checks that confirm a client-submitted UploadedFile reference (file ID or cloud URI) was actually issued to or is accessible by the requesting session/user before resolution.
- 3
Use unguessable, scoped identifiers
Generate cryptographically random, non-sequential object keys/IDs for uploaded files and avoid predictable naming schemes in cloud storage buckets.
- 4
Apply least-privilege storage credentials
Scope the server's IAM role or service account permissions to only the specific prefixes/objects needed per tenant or session rather than broad bucket/account-wide access.
- 5
Audit message history handling
Review any custom UI adapters or integrations for similar unvalidated forwarding of client-supplied resource references to privileged backend services.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.