Microsoft APM, an open-source dependency manager for AI agents, versions before 0.8.12 improperly limit pathname traversal when normalizing marketplace plugins. Specifically, attacker-controlled manifest fields (agents, skills, commands, hooks) can include absolute or '../' traversal paths that the implementation fails to restrict to the plugin directory. This flaw allows a malicious plugin to copy arbitrary readable files or directories from the installer's host machine during the 'apm install' process. The vulnerability is addressed in version 0.8.12.

An attacker can craft a malicious plugin that exploits this path traversal vulnerability to read arbitrary files or directories on the host system during plugin installation. This can lead to disclosure of sensitive information. There is no indication of privilege requirements or user interaction beyond plugin installation. The vulnerability does not impact system integrity or availability directly but compromises confidentiality.

Upgrade Microsoft APM to version 0.8.12 or later, where this path traversal vulnerability is fixed. Since this is a client-side tool and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor stating the issue is fixed in 0.8.12. Until upgraded, avoid installing untrusted or unverified plugins.