AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-p5rm-jg5c-8c77: Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

mediumvulnerability

security

Source: GitHub Advisory DatabaseJuly 24, 2026

Summary

Microsoft Kiota, a tool that generates AI plugin manifests from API descriptions, has a path traversal vulnerability (CWE-22, a security flaw where attackers access files outside intended directories) in how it validates file references. An attacker controlling the API description can use percent-encoding (a way of representing special characters as %XX codes) to bypass safety checks and reference files outside the plugin package, potentially exposing sensitive files like `/etc/passwd`. The initial fix in v1.32.5 failed because it checked the encoded string before decoding it, allowing attackers to hide traversal patterns in encoded form.

Solution / Mitigation

Upgrade to the first released `Microsoft.OpenApi.Kiota` version after 1.33.0 that includes the fixes from pull requests #7910 and #7913. The fix decodes percent-encoded references before validation, rejects control characters and NUL bytes (which could truncate paths), and applies NFKC-folding (a Unicode normalization technique) to catch homoglyph bypasses. Alternatively, only generate plugins from trusted API descriptions and manually review generated manifests to ensure `response_semantics.static_template.file` values are simple relative paths within the `adaptiveCards/` folder with no `..`, rooted paths, URIs, or percent-encoded separators.