CVE-2026-25592: 
Semantic Kernel vulnerability analysis and mitigation

CVE-2026-25592 is a critical Arbitrary File Write vulnerability in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin component. It affects Microsoft.SemanticKernel.Plugins.Core (NuGet) versions prior to 1.71.0 and semantic-kernel (pip) versions prior to 1.39.3. The vulnerability was published on February 6, 2026, and patched in the same release cycle. It carries a CVSS v3.1 base score of 9.9 (Critical) (Github Advisory, SK Security Advisory).

The root cause is a path traversal flaw (CWE-22) in the SessionsPythonPlugin's DownloadFileAsync and UploadFileAsync functions, which failed to validate or restrict the localFilePath argument before performing file system operations. An attacker with low privileges could supply a crafted path (e.g., using ../ sequences or absolute paths) to write arbitrary files to any location accessible by the application process. The fix introduced ValidateLocalPathForUpload and ValidateLocalPathForDownload methods that canonicalize paths using Path.GetFullPath() and enforce allowlist-based directory restrictions, with file uploads disabled by default via the EnableDangerousFileUploads flag (SK Security Advisory, SK PR #13478). The vulnerability is particularly relevant in AI agent contexts where an LLM may be manipulated via prompt injection to invoke these plugin functions with attacker-controlled arguments (Microsoft Security Blog).

Successful exploitation allows a low-privileged, network-based attacker to write arbitrary files to any location on the host system reachable by the Semantic Kernel process, with high impact to confidentiality, integrity, and availability. This can lead to remote code execution by overwriting application binaries, configuration files, startup scripts, or web shell deployment, and may enable lateral movement within the environment. The changed scope (S:C) in the CVSS score reflects that the impact extends beyond the vulnerable component itself to the broader host system (Github Advisory, Microsoft Security Blog).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Github Advisory). The EPSS score is approximately 0.098% (27th percentile), indicating a currently low probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack surface is notable because AI agent frameworks using Semantic Kernel may be susceptible to prompt injection attacks that could weaponize this vulnerability without direct attacker access to the API (Microsoft Security Blog, CTI Pilot).

1. Identify target: Locate applications built on Microsoft Semantic Kernel .NET SDK (versions < 1.71.0) that expose the SessionsPythonPlugin with file operations enabled (i.e., EnableDangerousFileUploads not restricted, or DownloadFileAsync accessible).
2. Obtain low-privileged access: Authenticate to the application with any valid low-privilege account, or craft a prompt injection payload if the application uses an LLM agent that can invoke Semantic Kernel plugin functions.
3. Craft malicious path: Prepare a localFilePath argument containing path traversal sequences (e.g., ../../etc/cron.d/backdoor on Linux, or C:\Windows\System32\malicious.dll on Windows) targeting a sensitive location.
4. Invoke vulnerable function: Call UploadFileAsync or DownloadFileAsync with the crafted localFilePath — either directly via the API or indirectly by injecting a prompt that instructs the AI agent to invoke the plugin function with the malicious path.
5. Write malicious payload: The plugin writes attacker-controlled content to the target path without validation, potentially placing a web shell, modifying startup scripts, or overwriting binaries.
6. Achieve code execution: Trigger execution of the written payload through normal application operation, scheduled tasks, or service restarts to gain arbitrary code execution on the host (SK Security Advisory, Microsoft Security Blog).

• File System: Unexpected files written outside the application's working directory, particularly in system directories (/etc/, /tmp/, C:\Windows\, web root directories); newly created scripts or executables with timestamps matching application activity.
• Logs: Application logs showing calls to UploadFileAsync or DownloadFileAsync with localFilePath values containing ../, absolute paths outside expected directories, or paths to sensitive system locations; InvalidOperationException errors referencing "Access denied" or "not within allowed directories" (post-patch, indicating attempted exploitation).
• Process: Unexpected child processes spawned by the Semantic Kernel application process (e.g., shells, interpreters); unusual outbound network connections following file write events.
• Network: Repeated or anomalous API calls to Semantic Kernel plugin endpoints with unusual parameter values; prompt injection patterns in LLM input logs referencing file paths or DownloadFileAsync/UploadFileAsync function names (SK Security Advisory, Microsoft Security Blog).

Upgrade Microsoft.SemanticKernel.Plugins.Core (NuGet) to version 1.71.0 or later, and semantic-kernel (pip) to version 1.39.3 or later. As an interim workaround, implement a Function Invocation Filter that validates the localFilePath argument passed to DownloadFileAsync and UploadFileAsync, ensuring it is restricted to an explicit allowlist of safe directories. Additionally, configure EnableDangerousFileUploads = false (the new default) and explicitly set AllowedUploadDirectories and AllowedDownloadDirectories if file operations are required (Github Advisory, SK PR #13478).

Microsoft published a security blog post in May 2026 contextualizing this vulnerability alongside related issues (CVE-2026-26030) as part of a broader discussion on RCE risks in AI agent frameworks, framing prompt injection as a key attack vector (Microsoft Security Blog). Security researchers and community members highlighted the vulnerability on Reddit and Bluesky, noting the novel attack surface created by AI agent function-calling mechanisms (Reddit). SecurityOnline.info covered the vulnerability with the headline "Critical Semantic Kernel Flaw (CVSS 10.0) Allows File Overwrite," reflecting community concern about the severity rating (SecurityOnline). The vulnerability was also cited in threat landscape digests and detection engineering newsletters as a representative example of emerging AI agent security risks (Detection Engineering).