CVE-2026-73851: Microsoft Kiota path traversal in plugin manifest via percent-encoding bypass

Executive brief

Kiota is a Microsoft tool that generates AI plugin manifests from API specifications. An attacker can inject specially crafted file paths—encoded using URL encoding tricks—into an API specification that the tool processes. If the generated plugin is deployed to an AI system, these malicious paths could allow an attacker to access sensitive files on the host system (such as configuration files or credentials) that should be restricted to the plugin package only. The vulnerability exists because the tool's security checks were bypassed by percent-encoded characters.

Technical details

The vulnerability is a path traversal (CWE-22) and untrusted functionality inclusion (CWE-829) in the plugin manifest generation logic. Kiota copies `x-ai-capabilities` OpenAPI extension fields (particularly `static_template.file` references) into generated manifest `response_semantics` sections. The validation function `ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference` in `src/Kiota.Builder/OpenApiExtensions/OpenApiAiCapabilitiesExtension.cs` inspected the raw reference string and rejected obvious traversal patterns (`..`, absolute paths, drive-qualified paths, absolute URIs). However, attackers could bypass these checks using percent-encoded equivalents (e.g., `%2e%2e/` for `../`, `file%3A%2F%2F` for `file://`) or multi-level encoding. Additional bypasses included NUL-byte truncation (`%00`), exceeding the decode budget, and Unicode full-width homoglyphs. Patches in v1.34.0 fix this by performing bounded multi-pass decoding before validation, failing closed on residual encoding, rejecting control characters, and NFKC-normalizing Unicode. The attack requires controlling or tampering with the OpenAPI description consumed by Kiota; when the manifest is later processed by an AI host, the unvalidated file references allow path traversal relative to the plugin package directory.

Affected products

• Microsoft Microsoft.OpenApi.Kiota >=1.30.0, <1.34.0 and <1.29.1

Timeline

• 2026-07-08: disclosed: Vulnerability published to GitHub Advisory Database
• 2026-07-08: patched: Fix released in v1.34.0 and v1.29.1

References

• https://api.github.com/users/gavinbarron
• https://github.com/gavinbarron
• https://api.github.com/users/gavinbarron/gists%7B/gist_id%7D
• https://api.github.com/users/gavinbarron/repos
• https://avatars.githubusercontent.com/u/7122716?v=4
• https://api.github.com/users/gavinbarron/events%7B/privacy%7D