CVE-2026-92215

Name of the Vulnerable Software and Affected Versions a2ui-project a2ui versions prior to 0.10.8

Description A server-side request forgery (SSRF) issue exists in the FileResolver component. This flaw allows a remote attacker to initiate an attack by manipulating the httpx.get() function located in the agent sdks/python/a2ui agent/src/a2ui/extensions/file resolve/file resolver.py file. Server-side request forgery is a technique where an attacker induces a server-side application to make requests to an unintended location.

Recommendations Deploy the patch with identifier 2bb8423060308bbdea8ba468dabed4fc256d18ea. As a temporary workaround, restrict the use of the httpx.get() function within the FileResolver component.