CVE-2026-44641CWE-22CWE-73

Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install

High · published May 15, 2026

CVSS v3.1
7.1
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.9th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
Published
2026-05-15T16:00Z
EPSS history
Timeline
  • 15 MAY 16:00Z
    Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install
    cvelistv5