.NET CVE-2026-25592
CRITICAL
GHSA-2ww3-72rp-wpp4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to application using Semantic Kernel
-
DeliveryInvoke SessionsPythonPlugin DownloadFileAsync
-
ExploitSupply path traversal payload in localFilePath
-
ExecutionWrite arbitrary file outside intended directory
-
ImpactExecute code or compromise system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Semantic Kernel .NET SDK versions prior to 1.71.0 with SessionsPythonPlugin enabled; authenticated user access required; application must call DownloadFileAsync or UploadFileAsync without validating localFilePath parameter against directory traversal attacks. |
| Impact | CVSS 9.9 — Semantic Kernel is widely used for enterprise AI applications. Path traversal enables AI agents to access sensitive files, configuration, and secrets on the host system. |
| Exploit ScenarioDerived | A prompt injection attack causes a Semantic Kernel-based AI agent to use the path traversal to read sensitive files like .env, database credentials, or SSH keys from the host system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files outside their intended scope.
Earlier versions of this analysis (1)
Path traversal in Semantic Kernel SDK enables AI agents to escape file access boundaries.
RemediationAI
Update Semantic Kernel. Implement strict file path validation for AI agent file operations.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in nuget, pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Semantic Kernel, Microsoft's SDK for building AI agents, has a CWE-22 path traversal that allows AI agents to read or write files outside their intended directory scope.
Know when .NET gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin. The problem has been fixed in Microsoft.SemanticKernel.Core version 1.71.0. As a mitigation, users can create a Function Invocation Filter which checks the arguments being passed to any calls to DownloadFileAsync or UploadFileAsync and ensures the provided localFilePath is allow listed.
Executive ViewAI
A critical path traversal vulnerability (CVE-2026-25592, CVSS 9.9) affects AI agent deployment platforms up to version 1.71.0, enabling attackers to access unauthorized files and potentially compromise system integrity. Organizations using affected versions face immediate risk of data exfiltration and system compromise, requiring urgent remediation despite low current exploit prevalence (0.1% EPSS).
Implement Web Application Firewall (WAF) rules to block path traversal attempts (../sequences, encoded variants); enforce strict input validation and sanitization; disable multi-agent system deployment features until patched; restrict file system permissions using principle of least privilege; enable detailed logging and monitoring of file access attempts; segment affected systems from sensitive data stores and production networks; consider rolling back to earlier unaffected versions if operationally viable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Remote code execution affects Windows desktop applications built on the Microsoft.WindowsDesktop.App.Runtime (WPF) compo
Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.
Argument injection in the CliInvoke .NET process-wrapping library (and its former identity, AlastairLundy.CliInvoke) all
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
Remote code execution in the ActiveMQ NMS AMQP .NET client affects all releases up to and including 2.3.0 when the clien
Exploit-DB