Log in Start free

Vulnerability · Published Aug 17, 2026 · Assigned by GitHub_M

CVE-2026-73851Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Medium 6.1

In plain English

A medium-severity path traversal in kiota from microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.1Medium
Exploit odds (30 days)2.3%top 16.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
NuGetmicrosoft.openapi.kiota1.34.0GHSA-p5rm-jg5c-8c77
NuGetmicrosoft.openapi.kiota1.29.1GHSA-p5rm-jg5c-8c77

Affected products (as reported)

VendorProductVersions
microsoft kiota >= 1.30.0, < 1.34.0< 1.29.1

Weakness: CWE-22, CWE-829 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

References