Executive brief
Microsoft's Semantic Kernel is a software framework used by developers to build AI-powered applications. The SessionsPythonPlugin component has a path traversal vulnerability that allows an attacker with valid credentials to write arbitrary files to the system by manipulating file path parameters in function calls, potentially leading to code execution and complete system compromise.
Technical details
An arbitrary file write vulnerability (CWE-22: Path Traversal) exists in the SessionsPythonPlugin component of Microsoft's Semantic Kernel, specifically in the DownloadFileAsync and UploadFileAsync functions. The vulnerable code fails to properly validate the localFilePath parameter passed through AI agent function calls, allowing an attacker to bypass directory restrictions. An authenticated attacker can exploit this to write files to arbitrary locations on the system. The vulnerability affects all versions of Microsoft.SemanticKernel.Plugins.Core before 1.71.0 and semantic-kernel (Python) before 1.39.3. Remediation via patch is available; as a workaround, developers can implement a Function Invocation Filter to allowlist file paths.
Affected products
- Microsoft Semantic Kernel Microsoft.SemanticKernel.Plugins.Core < 1.71.0
- Microsoft Semantic Kernel semantic-kernel (Python) < 1.39.3
Timeline
- 2026-02-06: disclosed: Vulnerability published as GHSA-2ww3-72rp-wpp4 and CVE-2026-25592
- 2026-02-06: patched: Microsoft.SemanticKernel.Plugins.Core 1.71.0 and semantic-kernel 1.39.3 released with fixes