GHSA-p5rm-jg5c-8c77: Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Summary

Microsoft Kiota generates AI plugin manifests from OpenAPI descriptions, and the file reference in response_semantics.static_template.file is resolved by the AI host relative to the plugin package. A crafted reference that is percent-encoded, NUL-terminated, or uses Unicode homoglyphs bypassed the IsSafeFileReference check added in v1.32.5, letting paths resolve outside the package. An attacker who controls or tampers with the OpenAPI description could cause inclusion or disclosure of files beyond the package boundary.

Mitigation

Fixed in the first released Microsoft.OpenApi.Kiota version after 1.33.0, which includes the patches from pull requests 7910 and 7913. Workarounds: only generate from trusted OpenAPI descriptions, and review generated manifests so that response_semantics.static_template.file is a simple relative path within the adaptiveCards/ folder.

Related items

• HighCVE-2026-108456 Azure AI Foundry Elevation of Privilege VulnerabilitySame vendor · MSRC Security Update Guide
• HighGHSA-h4xc-3qfq-jf93: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointSame vendor · GitHub Advisory Database
• LowGHSA-6gw6-rv2g-25mg: Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsSame vendor · GitHub Advisory Database
• MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
• HighCVE-2026-85887: M365 Copilot incorrect permission assignment allows information disclosureSame vendor · NVD/CVE Database