Executive brief
a2ui is an open-source framework for building AI-powered applications. The FileResolver component fails to properly validate URLs in the file resolution process, allowing attackers to make unauthorized HTTP requests to internal or external systems. This could lead to information disclosure, lateral movement within networks, or attacks on internal infrastructure.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the FileResolver component (file_resolve/file_resolver.py) due to improper validation of URLs passed to httpx.get. The vulnerable code does not adequately restrict which hosts can be accessed via HTTP requests, allowing attackers to craft malicious URLs that redirect to internal or restricted network resources. The fix involves defaulting allowed_hosts to an empty list, validating IP addresses on redirects, and mitigating DNS rebinding attacks by including proper validation of hostnames and schemes. No authentication is required to exploit this vulnerability, making it remotely accessible. The patch is available in commit 2bb8423060308bbdea8ba468dabed4fc256d18ea.
Affected products
- a2ui-project a2ui up to 0.10.7
Timeline
- 2026-09-16: disclosed
- 2026-08-26: patched: Patch commit 2bb8423060308bbdea8ba468dabed4fc256d18ea