PT-2026-60489 · Microsoft · Kiota

CVE-2026-59864 · Published 2026-07-16 · Updated 2026-07-16

Mitre

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate (with -t APIPlugin) emitted attacker-controlled static template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response semantics.static template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.32.5.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-829

Related Identifiers

CVE-2026-59864

Affected Products

Kiota

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-59864 · Security Note
• https://github.com/microsoft/kiota/security/advisories/GHSA-4jwf-m4wg-8p66 · Note
• https://github.com/microsoft/kiota/commit/9a185994a4e549b7bba3cc2beffb9736aa902e79 · Note
• https://github.com/microsoft/kiota/releases/tag/v1.32.5 · Note
• https://github.com/microsoft/kiota/pull/7892 · Note