The vulnerability in pydantic-ai arises from improper validation of UploadedFile references in client-submitted message history forwarded to model providers. While file URLs are validated against a scheme allowlist, UploadedFile references (e.g., provider file IDs or cloud storage URIs like s3:// or gs://) are not validated, allowing an attacker to cause the server to fetch arbitrary files using its own credentials. This can lead to unauthorized reading of files belonging to the server's account or other tenants if valid file identifiers are guessed or known. The vulnerability affects versions >=1.65.0 <=1.105.0. Patches in 1.106.0 and 2.0.0b6 introduce validation for these references to prevent exploitation.

An attacker can exploit this vulnerability to read files that the server has access to but the attacker should not, by submitting crafted message history containing UploadedFile references. This can lead to unauthorized disclosure of sensitive data stored in the server's model-provider or cloud-storage accounts. The CVSS score is 6.8 (medium severity), reflecting high confidentiality impact but no integrity or availability impact. Exploitation requires knowledge or guessability of valid file identifiers.

A fix is available in pydantic-ai versions 1.106.0 and 2.0.0b6, which validate UploadedFile references similarly to file URLs. Users should upgrade to these versions to remediate the vulnerability. If upgrading is not feasible, users should avoid passing untrusted client-submitted message history to the agent or strip UploadedFile parts from incoming messages before processing to prevent exploitation.