CVE-2026-25592: Semantic Kernel Path Traversal Flaw

CVE-2026-25592 Overview

An Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin component. Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to version 1.70.0, attackers with low privileges could exploit this vulnerability to write arbitrary files to the system via the DownloadFileAsync or UploadFileAsync functions without proper path validation.

Critical Impact

This vulnerability allows authenticated attackers to write arbitrary files to the file system through path traversal, potentially leading to remote code execution, system compromise, or complete takeover of affected AI agent deployments.

Affected Products

• Microsoft Semantic Kernel .NET SDK versions prior to 1.70.0
• Microsoft.SemanticKernel.Core NuGet package (all versions before 1.70.0)
• Applications using SessionsPythonPlugin with file transfer functionality

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-25592 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-25592

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The SessionsPythonPlugin component in Microsoft's Semantic Kernel .NET SDK fails to properly sanitize the localFilePath parameter in file transfer operations. When AI agents or multi-agent systems invoke file download or upload functionality, an attacker can craft malicious path inputs containing directory traversal sequences to write files outside the intended directory.

The vulnerability enables attackers to overwrite critical system files, plant malicious executables in startup directories, or modify configuration files to achieve persistent access. Given that Semantic Kernel is designed to orchestrate AI agents with broad system capabilities, a successful exploit could compromise the entire AI infrastructure and any systems the agents have access to.

Root Cause

The root cause stems from insufficient input validation in the DownloadFileAsync and UploadFileAsync methods within the SessionsPythonPlugin. The plugin accepts user-controlled file paths without verifying they remain within an allowed directory scope. Path traversal sequences such as ../ or absolute paths can bypass intended directory restrictions, allowing writes to arbitrary filesystem locations accessible to the application process.

Attack Vector

The attack is network-based and requires only low privileges to execute. An authenticated user with access to invoke Semantic Kernel plugin functions can craft malicious requests targeting the file transfer APIs. The attack does not require user interaction and can affect resources beyond the vulnerable component's security scope.

The exploitation flow involves:

1. Attacker identifies an application using Semantic Kernel with SessionsPythonPlugin
2. Attacker invokes DownloadFileAsync or UploadFileAsync with a crafted localFilePath containing traversal sequences
3. The vulnerable function processes the path without validation
4. Files are written to attacker-specified locations outside the intended directory

For technical details on the vulnerable code patterns, see the GitHub Security Advisory and the pull request containing the fix.

Detection Methods for CVE-2026-25592

Indicators of Compromise

• Unexpected file creation or modification in system directories, startup folders, or web server roots
• Log entries showing DownloadFileAsync or UploadFileAsync calls with path traversal sequences (../, ..\\, or absolute paths)
• New or modified files outside the expected Semantic Kernel working directories
• Anomalous process behavior from applications using Semantic Kernel plugins

Detection Strategies

• Monitor file system activity for writes originating from Semantic Kernel processes to directories outside designated working paths
• Implement application-level logging for all SessionsPythonPlugin file operations and alert on path patterns containing traversal characters
• Deploy endpoint detection rules to identify path traversal patterns in function arguments to AI agent plugins

Monitoring Recommendations

• Enable verbose logging for Semantic Kernel plugin invocations, particularly file transfer operations
• Configure file integrity monitoring on sensitive system directories
• Implement network-level monitoring for API calls to Semantic Kernel endpoints with suspicious path parameters

How to Mitigate CVE-2026-25592

Immediate Actions Required

• Upgrade Microsoft.SemanticKernel.Core to version 1.70.0 or later immediately
• Audit existing deployments for any signs of exploitation or unauthorized file modifications
• Review application logs for past invocations of DownloadFileAsync or UploadFileAsync with suspicious path arguments
• Restrict network access to Semantic Kernel-powered applications until patching is complete

Patch Information

Microsoft has addressed this vulnerability in Microsoft.SemanticKernel.Core version 1.70.0. The fix implements proper path validation to ensure file operations remain within allowed directories. Organizations should update their NuGet package dependencies and redeploy affected applications. For more details, see the GitHub Security Advisory.

Workarounds

• Create a Function Invocation Filter that validates the localFilePath argument before allowing calls to DownloadFileAsync or UploadFileAsync
• Implement an allowlist of permitted directories and reject any file paths that resolve outside these locations
• Use path canonicalization to detect and block traversal sequences before they reach the vulnerable functions

# Example: Update Semantic Kernel package via .NET CLI
dotnet add package Microsoft.SemanticKernel.Core --version 1.70.0

# Verify installed version
dotnet list package | grep SemanticKernel