CVE-2026-53598: Arbitrary File Read via File Reference Expansion in Microsoft Prompty

The Microsoft Prompty ecosystem provides cross-language runtimes designed to load and parse prompt templates stored in the .prompty file format. This format combines frontmatter configurations, containing metadata and execution parameters, with a markdown template body representing the prompt text. The parser allows developers to configure environment and file-level requirements directly inside the frontmatter parameters.

To facilitate structured prompts, the specification supports a reference expansion feature where sequence indicators like ${file:<path>} are evaluated dynamically. When the loader encounters this pattern, it resolves the designated path and embeds the file contents directly into the parsing tree. This sequence is evaluated across the Python, C#, Node.js/TypeScript, and Rust implementations.

Prior to version 2.0.0-beta.2, the implementation of the reference parser failed to perform boundary-containment checks during file resolution. This allowed any processed .prompty configuration file containing directory traversal or absolute paths to escape the authorized prompt directory. As a result, an attacker-controlled configuration file could leak sensitive operating system and application files.

The core issue resides in the dynamic reference-resolution phase of the frontmatter parser. When parsing a .prompty configuration file, the engine scans the frontmatter dictionary for any string properties matching the ${file:path} schema. Upon extraction of the path argument, the resolver constructs an absolute path on the host file system using the directory containing the active .prompty template as its base.

In vulnerable versions of the library, the reconstructed file path was passed directly to standard file-system read utilities without verifying that the resolved path remained a descendant of the prompt's source directory or an authorized boundary. Because the resolver did not assert path containment, characters like relative traversals, absolute drive identifiers, or local symbolic links were expanded literally.

This behavior allowed three exploitation patterns to succeed during the resolution phase. Relative traversals utilizing parent directories reached higher-level system paths. Absolute paths bypassed the template directory tree completely. Symbolic link escapes resolved the link targets to arbitrary system folders, bypassing logical directory sandboxes.

The fix for this vulnerability focuses on ensuring that any resolved file reference is constrained within a set of allowed directory roots. The default configurations dictate that only the directory containing the loaded .prompty template is considered a valid root.

# Python library fix implementation in prompty/core/loader.py
def _resolve_file_reference(
    agent_file: Path,
    reference: str,
    allowed_file_roots: Sequence[str | Path] | None,
) -> Path:
    """Resolve and validate a ``${file:...}`` reference."""
    # Canonicalize the parent directory of the prompt template
    prompt_root = agent_file.parent.resolve()
    
    # Establish allowed roots combining template directory and optional overrides
    allowed_roots = [prompt_root, *(Path(root).resolve() for root in allowed_file_roots or ())]
 
    candidate = Path(reference)
    if not candidate.is_absolute():
        candidate = prompt_root / candidate
 
    # Resolve symlinks and parent pointers to find the real physical path
    resolved = candidate.resolve()
    
    # Validate that the resolved target lies within one of the approved roots
    if not any(resolved == root or resolved.is_relative_to(root) for root in allowed_roots):
        roots = ", ".join(str(root) for root in allowed_roots)
        raise ValueError(
            f"File reference '{reference}' resolves outside allowed roots for '{agent_file}'. Allowed roots: {roots}"
        )
 
    return resolved

Comparing the vulnerable pattern to the updated logic reveals a transition to robust containment validation. The vulnerable code simply concatenated the relative path without performing .resolve() validation or testing with .is_relative_to(). The updated approach successfully blocks traversal payloads, absolute paths, and symbolic link targets resolving outside the approved boundary.

Exploitation of CVE-2026-53598 requires that an application ingest and parse a .prompty file containing an attacker-manipulated path. The attack surface typically manifests in platforms where users upload custom prompt configurations or when applications execute dynamic prompts retrieved from user-accessible sources.

An attacker supplies a template containing a payload in the metadata fields such as the description. When the application loads the configuration via load(), the parser extracts the arbitrary path from the reference sequence and reads the resource. The host application subsequently populates the parsed configuration object with the target content, exposing the sensitive data to the attacker through diagnostic logs, execution output, or UI responses.

The security impact of this vulnerability is categorized as high-severity confidential data exposure. Successful exploitation allows unauthorized, unauthenticated parties to read arbitrary files stored on the host running the vulnerable application, limited only by the host process's security permissions.

This flaw facilitates the extraction of configuration files, infrastructure-level environment variables, private SSL/TLS certificates, and application-specific secrets. In cloud-deployed applications, reading local configuration or metadata files can expose highly sensitive API tokens, database credentials, or identity access tokens. This level of exposure provides a path for horizontal escalation and broader system compromise.

While the vulnerability is restricted to read-only access and cannot directly manipulate system files or execute code, the extracted information is typically leveraged to execute subsequent attacks. Because no user interaction or authentication is required to trigger the path resolution, the exploitability vector remains simple and direct.

The primary remediation action requires upgrading all instances of the Microsoft Prompty package to version 2.0.0-beta.2 or newer across all target programming environments. Applications must specify the fixed versions within their respective package management configurations.

If legitimate configuration demands require reference expansion outside the prompt template directory, developers must explicitly define the approved directories during loading operations. The application API allows passing the optional allowed roots parameter to prevent throwing validation exceptions.

# Safe Python loading pattern with customized directory roots
from prompty import load
from pathlib import Path
 
# Safely load the prompt and limit traversal strictly to authorized paths
prompt = load(
    "prompts/chat.prompty",
    allowed_file_roots=[Path("/var/app/shared-templates")]
)

Where immediate package updates are not possible, temporary mitigations include establishing strict validation rules at the application layer to verify .prompty files before loader ingestion. Restricting directory write privileges for the application's runtime process also limits the files exposed in a traversal attack.