Microsoft Kiota versions before 1.32.5 do not properly validate per-client or per-plugin outputPath values in the .kiota/workspace.json configuration file during client or plugin generation. This allows a malicious repository or pull request to specify paths that traverse outside the workspace root, including absolute POSIX paths, UNC paths, Windows drive paths, or '..' segments, leading to arbitrary file writes on developer or CI hosts. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

An attacker who can influence the workspace configuration file can cause Kiota to write generated client files outside the intended workspace directory. This may lead to overwriting or creating files in arbitrary locations on the file system of the developer or continuous integration environment, potentially resulting in code execution or system compromise depending on the context and privileges of the Kiota process.

Upgrade to Microsoft Kiota version 1.32.5 or later, where this path traversal vulnerability is fixed. Since no official patch link or advisory is provided, verify the version upgrade from the vendor's official release notes or repository. Avoid using untrusted repositories or pull requests that could modify the .kiota/workspace.json configuration until the upgrade is applied.