What is the CVSS score of CVE-2026-46383?

CVE-2026-46383 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-46383?

Yes, a public proof-of-concept exploit is available for CVE-2026-46383. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-46383?

Yes, a patch is available for CVE-2026-46383. Update the affected software to the latest version immediately.

Microsoft APM CVE-2026-46383

EUVD-2026-30559 MEDIUM

Path Traversal (CWE-22)

2026-05-15 GitHub_M

GHSA-mq5j-pw29-jcv3

Path Traversal Python Microsoft

5.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 15, 2026 - 18:02 EUVD

Analysis Generated

May 15, 2026 - 17:16 vuln.today

DescriptionGitHub Advisory

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0.

AnalysisAI

Archive extraction boundary failure in Microsoft APM's legacy-bundle probe allows local attackers to overwrite arbitrary files on Windows systems running Python 3.10 or 3.11. When users run 'apm install' on a malicious .tar.gz file, untrusted tar members bypass path validation, enabling absolute path writes (e.g., D:/...) that compromise system integrity. Fixed in version 0.13.0. No active exploitation confirmed at time of analysis, but the local attack vector with user interaction required (CVSS AV:L/UI:R) limits real-world risk to social engineering scenarios targeting AI agent developers on Windows platforms.

Technical ContextAI

Microsoft APM is a community-driven dependency manager for AI agents. The vulnerability stems from CWE-22 (Path Traversal) in the legacy-bundle installation probe mechanism. When processing .tar.gz archives not recognized as standard plugin-format bundles, APM attempts to extract them as legacy '--format apm' bundles. On Python versions 3.10 and 3.11 (but not 3.12+, which includes enhanced path validation), the code uses raw tar.extractall() without sanitizing Windows absolute paths. The Windows filesystem allows absolute drive-prefixed paths like 'D:/arbitrary/location' in tar member names, which bypass Unix-style '../' traversal checks. This Windows-specific weakness in archive handling predates Python 3.12's security improvements to the tarfile module. The affected CPE (cpe:2.3:a:microsoft:apm:*:*:*:*:*:*:*:*) indicates all versions prior to 0.13.0 on Windows with Python 3.10/3.11 are vulnerable.

RemediationAI

Upgrade Microsoft APM to version 0.13.0 or later, which implements proper path validation for tar member extraction in the legacy-bundle probe. Vendor advisory available at https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3. For environments unable to immediately upgrade, implement compensating controls: (1) Upgrade Python runtime to 3.12 or later, which provides tarfile module hardening that blocks absolute path traversal independent of APM version - this is the strongest mitigation but may require application compatibility testing; (2) Restrict 'apm install' operations to trusted bundle sources only through organizational policy and code review processes - reduces attack surface but relies on human vigilance; (3) Run APM operations in sandboxed/containerized environments with minimal filesystem permissions to limit blast radius of arbitrary file writes - adds operational complexity and may break legitimate workflows requiring system-wide package installation. Note that workarounds do not eliminate the vulnerability, only reduce exploitation likelihood or impact.