CVE-2026-54249

Received Received - Intake

Path Traversal in Pydantic AI Framework

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application's model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client's, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-54249

Affected Vendors & Products

Vendor	Product	Version / Range
pydantic	pydantic	From 1.65.0 (inc) to 1.105.0 (inc)
pydantic	pydantic	From 2.0.0b1 (inc) to 2.0.0b5 (inc)
pydantic	pydantic	1.106.0
pydantic	pydantic	2.0.0b6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Pydantic AI versions 1.65.0 to 1.105.0 and 2.0.0b1 to 2.0.0b5 have a flaw where client-submitted message history can reference arbitrary files in the application's model-provider or cloud-storage account. UploadedFile references, which point to files by provider file ID or cloud-storage URI, were forwarded without validation. The server resolves these references using its own identity, allowing an attacker to read objects from its account or other tenants if they know a valid file identifier.

Detection Guidance

Detecting this vulnerability requires checking for Pydantic AI versions 1.65.0 through 1.105.0 or 2.0.0b1 through 2.0.0b5. Inspect installed packages using commands like 'pip show pydantic-ai' or 'pip list | grep pydantic-ai'. Review application logs for suspicious file access patterns or UploadedFile references in message history.

Impact Analysis

An attacker could exploit this to read sensitive files from your cloud storage or model-provider accounts, potentially exposing confidential data. This could lead to data breaches, unauthorized access to files, or leakage of sensitive information if the attacker knows or guesses file identifiers.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using affected versions may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Pydantic AI to versions 1.106.0 or 2.0.0b6 immediately. If upgrading is not possible, restrict file access permissions for the application's identity (IAM roles, service accounts) and validate all file references in message history before processing. Disable or audit the use of UploadedFile references in client submissions.

Hi! I’m here to help you understand CVE-2026-54249. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70