A Prompty loader references, causing the loader to read any file reachable from the prompt location. The flaw permits absolute paths, directory traversal, or symlink escapes, enabling an attacker to exfiltrate sensitive data from the host. The weakness is a confidentiality compromise stemming from improper input validation and path handling (CWE-200 and CWE-22).

Microsoft Prompty versions older than 2.0.0‑beta.2 are affected. The issue exists in all releases prior to the stated patch and applies to any system that processes .prompty frontmatter without additional restrictions.

The CVSS score of 7.5 indicates high severity, and the EPSS score of 1% shows a low a tangible risk, particularly in environments where prompt files can be influenced by attackers. The flaw remains not listed in the CISA KEV catalog. Because the flaw removes automatic path enforcement, it remains reasonably straightforward for a local attacker who controls or uploads a crafted prompt file to locate and read arbitrary files in the prompt directory. The prompt file; from that position the loader will resolve file references and return the file contents.