DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59864: CVE-2026-59864: Critical Out-of-Package Local File Inclusion in Microsoft Kiota

#security #cve #cybersecurity

CVE-2026-59864: Critical Out-of-Package Local File Inclusion in Microsoft Kiota

Vulnerability ID: CVE-2026-59864
CVSS Score: 9.3
Published: 2026-07-24

CVE-2026-59864 is a critical path traversal vulnerability in Microsoft Kiota occurring when custom OpenAPI extensions specify a nested static template file. Lack of input sanitization allows malicious inputs to write directory traversal sequences directly into plugin manifests, causing out-of-package local file disclosure in downstream environments like Microsoft 365 Copilot.

TL;DR

A critical path traversal vulnerability in Microsoft Kiota allows arbitrary out-of-package local file inclusion (LFI) in downstream hosts (e.g., Copilot, Teams) when processing malformed OpenAPI specifications.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22, CWE-829
  • Attack Vector: Network
  • CVSS Severity: 9.3 Critical
  • EPSS Score: 0.01275 (66.88th percentile)
  • Impact: Arbitrary Out-of-Package Local File Inclusion (LFI)
  • Exploit Status: PoC available in test suite
  • KEV Status: Not listed

Affected Systems

  • Microsoft Kiota Command Line Tool
  • Microsoft Kiota VS Code Extension
  • Microsoft Kiota NuGet Library Packages
  • kiota: < 1.32.5 (Fixed in: 1.32.5)

Code Analysis

Commit: 9a18599

Validate static_template file references in generated plugin manifests to block directory traversal

Mitigation Strategies

  • Upgrade the Microsoft Kiota CLI and developer dependencies to version 1.32.5 or higher.
  • Manually sanitize and audit custom OpenAPI specifications for x-ai-capabilities and x-ai-adaptive-card elements.
  • Enforce runtime directory restrictions at the downstream AI host application layer to reject out-of-package paths.

Remediation Steps:

  1. Identify all active developer environments using the Microsoft Kiota toolchain.
  2. Execute 'dotnet tool update -g Microsoft.OpenAPI.Kiota' to install version 1.32.5 or higher.
  3. Scan existing OpenAPI documents for the presence of 'x-ai-capabilities' or 'x-ai-adaptive-card' containing double-dot ('..') or absolute paths.
  4. Recompile all active plugins and redeploy the resulting safe manifests to Microsoft 365 Copilot and Teams.

References

Read the full report for CVE-2026-59864 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)