URL path injection exists in the Microsoft Graph adapter of Swoosh. The `Swoosh.Adapters.MsGraph` component constructs the Microsoft Graph API request URL by interpolating the sender's email address into the path `/users/{from}/sendMail` without validation or percent-encoding. In applications where the `from` address is derived from untrusted or user-influenced input, an attacker can use URL-special characters such as `/`, `?`, or `#` in the local part of the address to escape the intended path segment. This allows the attacker to rewrite the request path and query string, redirecting the authenticated POST request to other Graph endpoints within the token's scopes using the application's bearer token.