Microsoft APM allowed plugin developers to specify component file paths in plugin.json that were not constrained to the plugin directory. Attackers could therefore supply absolute paths or path‑traversal sequences like "../" to copy arbitrary readable files or directories from the host machine into the plugin installation location. The result is that sensitive data on the installer’s system can be read and placed in the plug‑in’s workspace without authorization. This flaw is classified as CWE‑22 (Path Traversal) and CWE‑73 (Path Manipulation).

Microsoft APM versions older than 0.8.12 are affected. The vulnerability manifests when installing marketplace plugins, as the implementation copies referenced components into .apm/ without validating the paths. Any instance of APM prior to 0.8.12 that accepts external plugin manifests can be impacted.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. The attack vector is inferred to be the installation of a malicious plugin from the marketplace; an attacker must be able to supply or modify the plugin.json file during installation. Fixing the vulnerability by upgrading to 0.8.12 removes the path validation flaw, preventing arbitrary file reads during plugin install.