CVE-2026-4964 | letta-ai letta 0.16.4 File URL message_helper.py _convert_message_create_to_message ImageContent server-side request forgery

A vulnerability was found in letta-ai letta 0.16.4 and classified as critical. This vulnerability affects the function _convert_message_create_to_message of the file letta/helpers/message_helper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request forgery.

This vulnerability is referenced as CVE-2026-4964. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.