Microsoft Kiota generates AI plugin manifests from OpenAPI descriptions. When the OpenAPI description includes certain AI capabilities referencing files, these file paths are resolved relative to the plugin package. CVE-2026-73851 arises because Kiota did not properly validate these file references after decoding percent-encoded or obfuscated inputs, allowing path traversal outside the package boundary (CWE-22) and inclusion of untrusted functionality (CWE-829). Initial mitigation in version 1.32.5 checked raw strings but missed encoded bypasses. Follow-up fixes decode references fully before validation, reject control characters, and normalize Unicode to prevent bypasses. The vulnerability affects versions prior to 1.29.1, with fixes included in releases after 1.33.0.

An attacker who can control or tamper with the OpenAPI description used by Kiota can craft file references that escape the intended plugin package directory. This can lead to inclusion or disclosure of arbitrary files outside the package boundary when the manifest is consumed by an AI host. This may expose sensitive files or cause unintended functionality inclusion, impacting confidentiality and integrity. The CVSS 4.0 score is 6.1 (medium severity), reflecting network attack vector, no privileges required, user interaction needed, and high scope impact.

A fix is available in Microsoft Kiota versions released after 1.33.0, which properly decode and validate file references to prevent path traversal. Users should upgrade to these fixed versions. Until upgrading, users should only generate clients/plugins from trusted OpenAPI descriptions and manually review generated plugin manifests to ensure that the 'response_semantics.static_template.file' field contains only simple relative paths within the expected package folder, rejecting any paths with traversal sequences, absolute paths, URIs, or percent-encoded separators.