SSRF File Scheme Local File Read - ATR-2026-01608 (aec8b176-96e1-5f28-9a98-a5ccbbdea036)
Detects SSRF attempts using the file:// URI scheme to read local filesystem files via an agent's HTTP-fetch or URL-retrieval tool. Unlike network-based SSRF, file:// scheme attacks directly read OS files such as /etc/passwd, /etc/shadow, SSH private keys, or application configuration files containing secrets. Many HTTP client libraries and agent tools support file:// URIs unless explicitly blocked. Also catches absolute path injection (/etc/passwd) as a direct file read vector in fetch-style tool arguments.