10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25592

CVE-2026-25592: Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

Impact

What kind of vulnerability is it? Who is impacted? An Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin. Developers who have built applications which include Microsoft's Semantic Kernel .NET SDK and are using the SessionsPythonPlugin

Patches

Has the problem been patched? What versions should users upgrade to? The problem has been fixed in Microsoft.SemanticKernel.Plugins.Core version 1.71.0. Users should upgrade to version 1.71.0 or higher.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading? Users can create a Function Invocation Filter which checks the arguments being passed to any calls to DownloadFileAsync  or UploadFileAsync and ensures the provided localFilePath is allow listed.

References

Are there any links users can visit to find out more?

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25592

CVE-2026-25592:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
semantic-kernel	pip	< 1.39.3	1.39.3
Microsoft.SemanticKernel.Core	nuget	< 1.71.0	1.71.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the SessionsPythonPlugin available in both the .NET and Python versions of the Semantic Kernel SDK. The core issue is a path traversal vulnerability within the UploadFileAsync/.upload_file and DownloadFileAsync/.download_file functions. These functions, which can be invoked by an AI agent, accepted a local file path from the agent without sufficient validation.

For uploads, an attacker could craft a malicious path (e.g., ../../../../path/to/sensitive/file) to make the AI agent read arbitrary files from the host filesystem and exfiltrate them. For downloads, an attacker could instruct the agent to write a file to an arbitrary location on the filesystem, potentially overwriting critical system or application files, which could lead to remote code execution.

The patch addresses this by introducing security controls that are disabled by default. To enable file operations, a developer must now explicitly set EnableDangerousFileUploads to true and configure an allowlist of directories for uploads (AllowedUploadDirectories) and downloads (AllowedDownloadDirectories). The patched functions now canonicalize the file paths using Path.GetFullPath (in .NET) or os.path.realpath (in Python) and validate them against the configured allowlists, effectively preventing the path traversal attacks.

Vulnerable functions

Microsoft.SemanticKernel.Plugins.Core.SessionsPythonPlugin.UploadFileAsync

dotnet/src/Plugins/Plugins.Core/CodeInterpreter/SessionsPythonPlugin.cs

The `UploadFileAsync` function was vulnerable to arbitrary file read via path traversal. It directly used the user-provided `localFilePath` to read a file from the filesystem without validation. An attacker could craft a malicious path (e.g., `../../../../etc/passwd`) to make the AI agent read and upload sensitive files from the host system.

Microsoft.SemanticKernel.Plugins.Core.SessionsPythonPlugin.DownloadFileAsync

dotnet/src/Plugins/Plugins.Core/CodeInterpreter/SessionsPythonPlugin.cs

The `DownloadFileAsync` function was vulnerable to arbitrary file write. It used the user-provided `localFilePath` to write a downloaded file to the filesystem without proper validation. An attacker could specify a malicious path to overwrite existing files or create new files in sensitive locations, leading to code execution or denial of service.

semantic_kernel.core_plugins.sessions_python_tool.sessions_python_plugin.SessionsPythonTool.upload_file

python/semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py

The `upload_file` function in the Python implementation was vulnerable to arbitrary file read. It lacked proper validation on the `local_file_path`, allowing an attacker to craft a path to read and upload arbitrary files from the local system by manipulating the AI agent.

semantic_kernel.core_plugins.sessions_python_tool.sessions_python_plugin.SessionsPythonTool.download_file

python/semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py

The `download_file` function in the Python implementation was vulnerable to arbitrary file write. It did not properly validate the `local_file_path` before writing the downloaded content. This could allow an attacker to overwrite arbitrary files on the system by manipulating the AI agent to provide a malicious path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-25592: Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

Impact

Patches

Workarounds

References

CVE-2026-25592:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

CVE-2026-25592: Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

Impact

Patches

Workarounds

References

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

10

10

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI