CVE-2026-46383: Microsoft APM path traversal in archive extraction

CVE-2026-46383 · Severity: medium · CVSS 5.5 · Published 2026-05-15

Microsoft APM, a dependency manager for AI agents, is vulnerable to a file-handling flaw on Windows systems. When a user attempts to install a specially crafted local archive file, the software may inadvertently overwrite or create files in arbitrary locations on the user's computer. This could allow an attacker to modify sensitive configuration files or system data if they can convince a user to run the install command on a malicious file.

Technologies: Microsoft Apm-Cli. Vendors: Microsoft, PyPI.

Quick answers

Is CVE-2026-46383 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46383 being exploited in the wild.
How severe is CVE-2026-46383?
Medium severity, with a CVSS score of 5.5, published 15 May 2026.
Which products and versions are affected?
Microsoft Apm-Cli <= 0.12.4; apm-cli (PyPI) ECOSYSTEM:introduced=0,fixed=0.13.0.
Is there a fix for CVE-2026-46383?
Yes. apm-cli (PyPI): upgrade to 0.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46383 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-46383?
Check whether you run Microsoft Apm-Cli or apm-cli (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • apm-cli (PyPI): upgrade to 0.13.0 or later
    pip install "apm-cli>=0.13.0"

Technical details

A path traversal vulnerability exists in Microsoft APM (apm-cli) prior to version 0.13.0 when running on Windows with Python 3.10 or 3.11. The vulnerability occurs in the `_looks_like_legacy_apm_bundle()` function within `src/apm_cli/bundle/local_bundle.py`. When the `apm install` command is used on a local `.tar.gz` file, the application probes the archive to determine if it is a legacy bundle by calling `tar.extractall()`. On affected Python versions, this call does not properly validate Windows absolute paths (e.g., `D:/...`), allowing an attacker to craft an archive that writes or overwrites files outside the intended extraction directory. This occurs during the classification phase, even if the bundle is ultimately rejected as invalid. The issue is fixed in version 0.13.0 by implementing proper path validation.

Affected products

  • Microsoft APM (apm-cli) < 0.13.0

Identifiers

  • CVE-2026-46383
  • GHSA-mq5j-pw29-jcv3
  • PYSEC-2026-2378

Timeline

  • 2026-05-11: advisory: GitHub Security Advisory published
  • 2026-05-15: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.