CVE-2026-73851mediumCWE-22CWE-829

CVE-2026-73851: medium-severity vulnerability in microsoft kiota

Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Published

Follow this CVE+ Monitor kiota+ Monitor Microsoft.OpenApi.Kiota

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 2.3%
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
microsoft · kiota
Related CVEs — microsoft kiota

In the same product, most dangerous first.

CVE-2026-59865CRITICALKiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`EPSS 4.4%CVE-2026-59867HIGHKiota: Generation-time SSRF + remote/local file inclusion via unrestricted $refEPSS 2.4%CVE-2026-59861HIGHKiota: Code Generation Literal Injection in Kiota Ruby GeneratorEPSS 2.0%CVE-2026-59866CRITICALKiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNameEPSS 1.4%CVE-2026-59859HIGHKiota: Code Generation Literal Injection in the PHP GeneratorEPSS 1.4%CVE-2026-59860HIGHKiota: XML Doc-Comment Newline Breakout Code InjectionEPSS 1.4%