Aug 2026: Kiota: Path traversal in generated plugin manifest static_template.file reference (percent
CVE-2026-73851 Published on August 17, 2026
Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.
Vulnerability Analysis
CVE-2026-73851 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-73851 has been classified to as a Directory traversal vulnerability or weakness.
Inclusion of Functionality from Untrusted Control Sphere
The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Affected Versions
microsoft kiota:- Version >= 1.30.0, < 1.34.0 is affected.
- Version < 1.29.1 is affected.