PT-2026-41316 · Microsoft · Apm

Published 2026-05-15 · Updated 2026-07-13 · CVE-2026-45539

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft APM versions 0.5.4 through 0.12.4

Description Two primitive integrators in apm-cli use Path.glob() and Path.rglob() to enumerate package files and Path.read text() to read matches, which transparently follows symbolic links. A symlink within a remote dependency located under '.apm/prompts/.prompt.md' or '.apm/agents/.agent.md' is preserved during cloning and dereferenced during integration. This results in the resolved content being written as a regular file into the project's deploy directories. This process is not detected by the content hash, the pre-deploy SecurityGate scan, or apm audit. Because deploy roots are not added to the auto-generated '.gitignore', these files are staged by default when using 'git add'.

Recommendations Update to version 0.13.0.

Exploit

Fix

Information Disclosure

Link Following

Weakness Enumeration

CWE-200

CWE-59

Related Identifiers

CVE-2026-45539

GHSA-Q5PP-GVJG-H7V4

PYSEC-2026-2377

Affected Products

Apm

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45539.json · Exploit
• 🔥 https://github.com/microsoft/apm/security/advisories/GHSA-q5pp-gvjg-h7v4 · Exploit
• https://osv.dev/vulnerability/CVE-2026-45539 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q5pp-gvjg-h7v4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45539 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2377 · Vendor Advisory
• https://github.com/microsoft/apm · Note
• https://github.com/microsoft/apm/commit/f85b9f54ad303159f9c448268eb7005c319fe02a · Note
• https://github.com/microsoft/apm/releases/tag/v0.13.0 · Note
• https://twitter.com/f1tym1/status/2055509623948337469 · Twitter Post
• https://github.com/advisories/GHSA-q5pp-gvjg-h7v4 · Note
• https://pypi.org/project/apm · Note
• https://t.me/CVEtracker/53929 · Telegram Post