CVE-2026-92215: a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery
A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agentsdks/python/a2uiagent/src/a2ui/extensions/fileresolve/fileresolver.py of the component FileResolver. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The identifier of the patch is 2bb8423060308bbdea8ba468dabed4fc256d18ea. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2ui-project/a2ui (FileResolver)to a version that resolves this vulnerability.Patch 2bb8423060308bbdea8ba468dabed4fc256d18ea
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is remotely exploitable over the network with low attack complexity. The supplied CVSS vector indicates that no privileges or user interaction are required.
Which deployments should be prioritized for remediation?
Deployments of a2ui-project/a2ui through version 0.10.7 that include the FileResolver component should be prioritized. The affected code is the httpx.get use in agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py.
What is the available remediation?
Deploy the patch identified as 2bb8423060308bbdea8ba468dabed4fc256d18ea. No alternative mitigation is provided in the available information.
What impact is indicated if exploitation succeeds?
The CVSS vector rates confidentiality, integrity, and availability impact as low. The overall CVSS severity is high, with a score of 7.3.