A vulnerability has been found in a2ui-project a2ui up to 0.10.7. (CVE-2026-92215)
A server-side request forgery (SSRF) vulnerability exists in a2ui-project a2ui up to version 0.10.7. The flaw is in the httpx.get function within the FileResolver component, allowing remote attackers to initiate SSRF attacks. A patch has been identified to fix this issue.
AI Analysis
Technical Summary
CVE-2026-92215 describes a server-side request forgery vulnerability in the a2ui-project a2ui software, specifically affecting the httpx.get function in the agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py file of the FileResolver component. This vulnerability allows remote attackers to manipulate the function to perform SSRF attacks. The vulnerability affects versions up to 0.10.7. A patch identified by commit 2bb8423060308bbdea8ba468dabed4fc256d18ea is recommended to remediate the issue.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to cause the server to make unintended requests, potentially leading to information disclosure, limited integrity loss, and availability impact as indicated by the CVSS vector (C:L/I:L/A:L). The attack can be initiated remotely without authentication.
Mitigation Recommendations
A patch has been identified for this vulnerability (commit 2bb8423060308bbdea8ba468dabed4fc256d18ea). It is recommended to deploy this patch to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or if the patch is already integrated in newer versions.
A vulnerability has been found in a2ui-project a2ui up to 0.10.7. (CVE-2026-92215)
Description
A server-side request forgery (SSRF) vulnerability exists in a2ui-project a2ui up to version 0.10.7. The flaw is in the httpx.get function within the FileResolver component, allowing remote attackers to initiate SSRF attacks. A patch has been identified to fix this issue.
CVSS v3.1
Score 7.3high
Affected software
pkg:github/a2ui-project/a2uiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92215 describes a server-side request forgery vulnerability in the a2ui-project a2ui software, specifically affecting the httpx.get function in the agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py file of the FileResolver component. This vulnerability allows remote attackers to manipulate the function to perform SSRF attacks. The vulnerability affects versions up to 0.10.7. A patch identified by commit 2bb8423060308bbdea8ba468dabed4fc256d18ea is recommended to remediate the issue.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to cause the server to make unintended requests, potentially leading to information disclosure, limited integrity loss, and availability impact as indicated by the CVSS vector (C:L/I:L/A:L). The attack can be initiated remotely without authentication.
Mitigation Recommendations
A patch has been identified for this vulnerability (commit 2bb8423060308bbdea8ba468dabed4fc256d18ea). It is recommended to deploy this patch to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or if the patch is already integrated in newer versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-c3w9-49h5-9jjq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-92215"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa2c2f55bf5e2cf5101b8c
Added to database: 09/16/2026, 05:42:07 UTC
Last enriched: 09/16/2026, 05:48:06 UTC
Last updated: 09/16/2026, 07:01:23 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.