CVE-2026-54249: Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application’s model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server’s own credentials, allowing the client to read files it should not have access to.