Microsoft Kiota, an OpenAPI-based HTTP client code generator, had a path traversal vulnerability (CWE-22) in versions before 1.32.5. Specifically, the commands `kiota plugin add` and `kiota plugin generate` (with the APIPlugin target) emitted static_template.file values derived from attacker-controlled fields (x-ai-adaptive-card and x-ai-capabilities) into Microsoft 365 Copilot and Teams plugin manifests without validating the file paths. This lack of validation allowed maliciously crafted paths including directory traversal sequences and absolute or UNC paths to be injected, leading to potential path traversal or inclusion of files outside the intended package scope when the plugin was deployed. The vulnerability has a CVSS 4.0 score of 9.3 (critical) and is fixed in version 1.32.5. The product is a cloud service, so remediation is managed by the vendor.

Exploitation of this vulnerability could allow an attacker to cause path traversal or include files outside the intended package boundaries in generated Microsoft 365 Copilot and Teams plugins. This can lead to unauthorized file access or manipulation when the plugin is deployed, potentially compromising system integrity or confidentiality. The CVSS score of 9.3 indicates a critical impact with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

A fix is available in Microsoft Kiota version 1.32.5. Since Kiota is a cloud service, Microsoft manages remediation for this service. Users should ensure they are using version 1.32.5 or later. Check the official Microsoft advisory for confirmation and further guidance. No additional mitigation steps are indicated by the vendor advisory.